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Preface 


This applecation note is the reference 
to control flash memory included in the 
M16C of Mitsubishi 16-bit 
microcomputers. 

For details about instruction, please 
refer to the software manual supplied 
with your microcomputer. 


Guide to Using This Manual 


This manual is a reference for making boot rogram. 
This manual consists of five chapters. Do not need to take a look at every chapter. 
Look at a necessary chapter, according to a flowchart shown below. 


To know about M16C's Make boot program 
flash memory 


Chapter 1 


Using M16C/20 Using M16C/62 Using M16C/80 


Chapter 2 Chapter 3 Chapter 4 


Set protect to the 
program code 


Yes 


Practice 
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Chapter 1 
Outline of M16C Internal Flash MCU 


1.1 What Is Flash Memory? 
1.2 M16C Family and Flash Memory 
1.3 Controlling Flash Memory On-Board 
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1.1 What Is Flash Memory? 


Flash memory has since around the middle of 1980s been available as an electrically programmable/erasable 
memory product that does not require battery backup. In recent years, flash memory has been widely used 
in portable telephones (including PHS), notebook personal computers, and various other portable equipment. 
This section describes advantages of flash memory and available types. 


Advantages of Flash Memory 


Flash memory is electrically rewritable nonvolatile memory. Compared to other products such as EPROM 
and EEPROM that have the same functionality, flash memory is significantly advantageous in chip size 
and cost. The following lists advantages of flash memory: 


(1) Small chip size 
The EEPROM memory cell consists of two transistors, whereas that of flash memory consists of one 
transistor as does EPROM. Therefore, when manufactured using the same fabrication method to provide 
the same memory capacity as other memory products, flash memory can be manufactured in smaller chip 
size. 


(2) Encapsulated in plastic packages 
EPROM requires a window-fitted package because its data is erased by irradiating ultraviolet rays upon it, 
and cannot be encapsulated in a plastic package. On the other hand, flash memory does not require a 
window-fitted package because it is electrically erasable, and can be encapsulated in a plastic package. 


(3) Unnecessary IC sockets 
When mounted on the circuit board, EPROM requires use of an IC socket because it needs to be placed 
in a ultraviolet radiation unit to erase its data. On the other hand, flash memory can be mounted directly on 
the circuit board because its data can be electrically erased. 


Table 1.1.1 Comparison between Flash Memory and EPROM and EEPROM 


Flash memory EPROM EEPROM 


Chip size Small Small Not small 


Capsulated in plastic packages Possible Possible Impossible 


IC socket Not use use Not use 
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Types of Flash Memory 


There are several types of cell structures that comprise flash memory. These, for example, include NOR, 
DINOR, and AND types. Each type is taken advantage of when using flash memory. 


(1) NOR type 
The NOR-type cell structure is the same as that of EPROM. Also, because cells can be read at random, 
EPROM can easily be replaced with this type of flash memory. 


(2) DINOR type 
The DINOR-type cell structure draws on the tunnel effect to write and erase data. Therefore, this type of 
flash memory does not require a large current for program/erase operation, making it suitable for use in 
low-voltage, single-power supply applications. 


(3) AND type 
The feature of AND type is a reduced cell size, so that its cell structure is ideal for large-capacity memory. 
Because cell data is read out by serial access, this type of flash memory is used mainly for data storage 
purposes. 
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1.2 M16C Family and Flash Memory 


The M16C family microcomputers have been well received in consumer electronics and industrial fields for 
their numerous features including high-efficiency C language support, high performance, superior noise 
characteristics, and low power consumption. In addition to conventional mask ROM and OTP, a new product 
with built-in flash memory has been added to the lineup. This section explains about the flash memory that is 
incorporated in the M16C family microcomputers. 


Flash Memory Incorporated in The M16C Family 


The M16C family microcomputers incorporate suitable types of flash memory to meet the application 
needs of each group. The M16C/20 group incorporates the NOR type, while the M16C/62 and 80 groups 


incorporate the DINOR type. 


Table 1.2.1 Flash Memory Incorporated in The M16C Family 
M16C/20 group M16C/62 and 80 groups 


Cell structure NOR type DINOR type 


Access method Random access Random access 


Programming method Byte write Page write 


Erasing method Collective erase Block by block erase 


Read/Write Modes 


The flash memory built into the M16C can be read/written in three modes. 


(1) Parallel input/output mode 
In this mode, a general-purpose programmer or the suitable flash programmer are used to read or write 


data. Part of MCU pins are used to send control signals. No software is required. 


(2) Serial input/output mode 
Read/write operations are controlled via serial interface using part of MCU pins. Data can be read/written 
using the suitable serial programmer. Software is required, which can be either the standard boot program 
or a user boot program that supports the protocol of the serial programmer. 


(3) CPU rewrite mode 
Read/write operations are controlled by setting the control registers in a user program. Software is required, 
which includes a read program, a write program, and a user boot program including a RAM transfer program. 
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Standard Boot Program and User Boot Program 


The boot program used to control read/writes to flash memory can be the standard boot program that is 
already included in flash memory or a boot program created by the user to suit the application system. 
The standard boot program is prepared by the manufacturer to control flash memory using the manufacturer- 
designated method. Normally, this program is stored in the boot ROM area. On the other hand, the user 
boot program is created by the user to control flash memory using the user's own exclusive method. 
Normally, this program will be stored in the user ROM area. 

Table 1.2.2 compares between the standard boot program and user boot program. 


Table 1.2.2 Comparing between The Standard Boot Program and User Boot Program 


Standard write program User boot program 


Source Supplied by manufacturer Created by user 


Required hardware 
(internal functions) Fixed Free 


Stored location Boot ROM area User ROM area 
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1.3 Controlling Flash Memory On-Board 


To control flash memory on-board, you need to follow a predetermined procedure. This section describes the 
procedure for controlling flash memory. 


Outline of Operation 


To control the flash memory built in the M16C, you need to have a program (write control program), known 
as the boot program, which is necessary to program/erase the flash memory and a program to transfer the 
said program to RAM. These programs must be written into memory using a general-purpose programmer 
or a dedicated serial programmer beforehand. 

To control flash memory, first transfer the write control program to a RAM area using the RAM transfer 
program. Then execute the write control program from RAM to write to the flash memory on-board. 
Figure 1.3.1 shows an outline of operation when controlling flash memory. 
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(1) After reset 
M16C internal flash MCU Source (serial programmer) 


Flash memory 


--- Written beforehand 


(2) Transfer the write program to RAM 
M16C internal flash MCU Source 


— = memory 


ee control 
stat 7 E rogram 


(3) Write application program to flash memory 
M16C internal flash MCU Source 


Flash memory 


WM. 


Figure 1.3.1 Operation When Controlling Flash Memory 
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Flow of Boot Program 


Figure 1.3.2 shows a boot program flowchart. 

Detail algorithms necessary to program/erase flash memory vary with each group. This is explained in 
Chapter 2 for the M16C/20 group, and in Chapter 3 for the M16C/62 group. For the M16C/80 group, this 
is explained in Chapter 4. 


Flash memory 
rewrite starts 


iatedtata talalatalnitialata siete] Gaiiuiatatialtsialalciatas RAM transfer program 


Transfer write control 
program to RAM area 


Jump to RAM area 


Flash memory 
rewrite finished 


Figure 1.3.2 Flow of Boot Program 
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M16C/20 Group 


2.1 Outline of Hardware 

2.2 Developing Boot Program 
2.3 Sample Program List 

2.4 Precautions 
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M16C/20 Group 
2.1 Outline of Hardware 


The M16C/20 group contains NOR-type flash memory. 
This section shows hardware information about the M16C/20 group which we think is necessary to create a 


boot program. 


Internal Flash Memory Outline 


Table 2.1.1 shows the outline performance of M30201F4 of the M16C/20 group. 


Table 2.1.1. Outline Performance of M30201F4 


Item 


Performance 


Power supply voltage 


4.0V to 5.5 V (f(XIN)=10MHz) 


Program/erase voltage 


VPP=12V + 5% (f(XIN)=10MHz) 


VoC=5V + 5% (f(XIN)=10MHz) 


Flash memory operation mode 


Three modes (parallel I/O, standard serial I/O, CPU 
rewrite) 


Erase block | User ROM area 


See Figure 2.1.1. 


Gbasian | Boot ROM area 


Program method 


One division (3.5 Kbytes) (Note) 


In units of byte 


Erase method 


Collective erase 


Program/erase control method 


Program/erase control by software command 


Number of commands 


6 commands 


Program/erase count 


100 times 


ROM code protect 


Parallel I/O mode is supported. 


Note: The boot ROM area contains a standard serial I/O mode control program which is stored in it 
when shipped from the factory. This area can be erased and programmed in only parallel I/O 


mode. 
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Memory Map 


Figure 2.1.1 shows a memory map of the M30201F4. Among the memory areas are a boot ROM area and 
a user ROM area. Both areas can be accessed for program, read, verify, and erase in parallel input/output 
mode. In CPU rewrite mode, however, the boot ROM area cannot be accessed for program, verify, and 
erase. 


0000016 
0040016 
OOBFF 16 
DF00016 Can be erased/programmed 
Boot ROM in only parallel input/output 
Ok mode 
area 
(3.5 Kbytes) 
DFBFF16 
F400016 
User ROM 
area 
(48 Kbytes) 
FFFFF16 


Figure 2.1.1 M30201F4 Memory Map 
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Related Register Configuration 


Figure 2.1.2 shows related registers for making user boot program. 


Flash memory control register 0 


b7 b6 b5 b4 b3 b2 bi bo Symbol Address When reset 
lo PX] tf of of [xX] | FCONO 03B416 001000002 


' | FCONOO | CPU rewrite mode 0: CPU rewrite mode is invalid 
select bit 1: CPU rewrite mode is valid 


Reserved bit This bit can not write. The value, if 
read, turns out to be indeterminate. 


cee FCON02 | CPU rewrite mode 0: CPU rewrite mode is invalid 
oe ae abe UP SESE monitor flag 1: CPU rewrite mode is valid 
eee Reserved bit Must always be set to "0". lo:0) 


My eee area rae Reserved bit Must always be set to "1". 


io Nothing is assigned. In an attempt to write this bit, write "0". The value, 
if read, turns out to be "0". 


nerds stabs seh ah as Reserved bit Must always be set to "0". 0/0) 


Flash memory control register 1 
—-— b1__bo Symbol Address When reset 
XXX] 0 | 0] FCON1 03B516 XXXXXX002 
seeneee 
+ Reserved bit Must always be set to "0". lolo| 


Nothing is assigned. In an attempt to write these bits, write "0". The 
value, if read, turns out to be indeterminate. 


Flash command register 


b7 b6 bS b4 b3_b2 bi b0 Symbol Address When reset 
FCMD 03B616 0016 


Writing of software command 
<Software command name> <Command code> 
*Read command "0016" 


*Program command "A016" 
¢Program verify command "C016" 
*Erase command "2016" +"2016" 
*Erase verify command "A016" 
*Reset command "FF16" +"FF6" 


Figure 2.1.2 Related Register Configuration 
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Flash Control Circuit 


M16C/20 Group 
2.1 Outline of Hardware 


The M16C/20's flash control circuit controls the program, read, verify, and erase operations performed on the 
internal flash memory. Operation modes are selected by writing commands to the Flash Memory Control 
Register (addresses 03B416, 03B516) and Flash Command Register (address 03B616). Among the memory 
areas are a boot ROM area and a user ROM area. Both areas can be accessed for program, read, verify, and 
erase in parallel input/output mode. In CPU rewrite mode, however, the boot ROM area cannot be accessed 


for program, verify, and erase. 


Software Commands 


Table 2.1.2 lists software commands. 


When CPU rewrite mode is effective, write software commands to the Flash Command Register to specify 


the program or erase operations to be performed. 


Table 2.1.2 Software Command List 


First bus cycle 


Second bus cycle 


Command Data 
Mode | Address | (Do to D7) 


Read i 03B616 


Mode | Address (Do to Dy) 


Program i 03B616 


Program | Program 
address data 


Program verify i 03B616 


Verify Verify 
address data 


Erase i 03B616 


03B616 2016 


Erase verify i 03B616 


Verify Verify 
address data 


Reset i 03B616 


Read Command (0016) 


03B616 FF16 


The read mode is entered by writing the command code “0016” to the flash command register in the first 
bus cycle. When an address to be read is input in one of the bus cycles that follow, the content of the 
specified address is read out at the data bus (Do—D7), 8 bits at a time. 

The read mode is retained intact until another command is written. 

After reset and after the reset command is executed, the read mode is set. 
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Program Command (4016) 


The program mode is entered by writing the command code “4016” to the flash command register in the 
first bus cycle. When the user execute an instruction to write byte data to the desired address (e.g., STE 
instruction) in the second bus cycle, the flash memory control circuit executes the program operation. The 
program operation requires approximately 20 us. Wait for 20 us or more before the user go to the next 
processing. 

During program operation, the watchdog timer remains idle, with the value “7FFF16” set in it. 


Note 1: The write operation is not completed immediately by writing a program command once. The user 
must always execute a program-verify command after each program command executed. And if 
verification fails, the user need to execute the program command repeatedly until the verification 
passes. See Figure 2.1.3 for an example of a programming flowchart. 


Program-Verify Command (C016) 


The program-verify mode is entered by writing the command code “C016” to the flash command register in 
the first bus cycle. When the user execute an instruction (e.g., LDE instruction) to read byte data from the 
address to be verified (the previously programmed address) in the second bus cycle, the content that has 
actually been written to the address is read out from the memory. 

The CPU compares this read data with the data that it previously wrote to the address using the program 
commana. If the compared data do not match, the user need to execute the program and program-verify 
operations one more time. 


Erase Command (2016 + 2016) 


The flash memory control circuit executes an erase operation by writing command code “2016” to the flash 
command register in the first bus cycle and the same command code to the flash command register again 
in the second bus cycle. The erase operation requires approximately 20 ms. Wait for 20 ms or more before 
the user go to the next processing. 

Before this erase command can be performed, all memory locations to be erased must have had data 
“0016” written to by using the program and program-verify commands. During erase operation, the watchdog 
timer remains idle, with the value “7FFF16 set in it. 


Note 1: The erase operation is not completed immediately by writing an erase command once. The user 
must always execute an erase-verify command after each erase command executed. And if 
verification fails, the user need to execute the erase command repeatedly until the verification 
passes. See Figure 2.1.3 for an example of an erase flowchart. 
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Erase-Verify Command (A016) 


The erase-verify mode is entered by writing the command code “A016” to the flash command register in 

the first bus cycle. When the user execute an instruction to read byte data from the address to be verified 

(e.g., LDE instruction) in the second bus cycle, the content of the address is read out. 

The CPU must sequentially erase-verify memory contents one address at a time, over the entire area 

erased. If any address is encountered whose content is not “FF 16” (not erased), the CPU must stop erase- 

verify at that point and execute erase and erase-verify operations one more time. 

Note 1: If any unerased memory location is encountered during erase-verify operation, be sure to execute 
erase and erase-verify operations one more time. In this case, however, the user does not need to 
write data “0016” to memory before erasing. 


Reset Command (FF16 + FF16) 


The reset command is used to stop the program command or the erase command in the middle of operation. 
After writing command code “4016” or “2016” twice to the flash command register, write command code 
“FF16” to the flash command register in the first bus cycle and the same command code to the flash 
command register again in the second bus cycle. The program command or erase command is disabled, 
with the flash memory placed in read mode. 
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Program 


Address = first location 


Loop counter : X=0 


> 


Write program 
command 


Write : 4016 


address 


| Write program data/ 


Write : Program data 


Duration = 20 us 


Loop counter : X=X+1 


Write program verify 


command Write : C016 


Duration = 6 us 


Next 
address ? 


address ? 


YES 
Write read command 
( PASS ) 


Write read command 


Write : 0016 


Erase 


All bytes = 
"0016"? 


Program all bytes = 
"0016" 


Address = First address 


Loop counter X=0 


Write erase command 
Write erase command 


Duration = 20ms 


Loop counter X=X+1 


Write erase verify 
command/address 


Duration = 6yus 


Next 
address ? 


Last 
address? 


Write:2016 


Write:2016 


Write:A016 


YES 


PASS - 


FAIL 
Read: 
expect value=FF16 


| Write read command 


Write read command 


i 


il Write:0016 


( PASS ) 


( FAIL ) 


Figure 2.1.3 Program and Erase Execution Flowchart in The CPU Rewrite Mode 


16 


M16C/20 Group 
2 2.2 Developing The Boot Program 


2.2 Developing The Boot Program 


The standard boot program that was built into the boot ROM area of the flash microcomputer when shipped 
from the factory can be used to program/erase the flash memory. In this case, the hardware resources 
(internal functions) used for control are fixed. Therefore, if you want to control flash memory in the way 
suitable for your system, you need to create a boot program for yourself. 

This section shows an algorithm for the boot program (e.g., for erase and program) that you must at least 
have in order to control the flash memory of the M16C/20 group. 


System Example 


By using the internal peripheral function of UARTO and a serial programmer to control flash memory, the 
following shows an example of device connections is shown in Figure 2.2.1. Assignments of internal 
peripheral functions are listed in Table 2.2.1. 


Clock input CLKO 
P53(BUSY) 


100 
M30201 Flash 


(1) Control pins and external circuitry will vary according to peripheral unit (programmer). For more 
information, see the peripheral unit (programmer) manual. 
(2) In this example, the microprocessor mode and standard serial I/O mode are switched via a switch. 


Figure 2.2.1 Example of Device Connection 


Table 2.2.1 Assignments of Internal Peripheral Functions 


Peripheral : 
function Usage Setting example 


Used for transfer/receive of serial programmer and | * Clock synchronous serial I/O 


aia data ¢ External clock used 


Timer AO Used for time-over judgment of serial transfer/ * One-shot timer mode 
receive * 300 us(at 10MHz) 
Used to watch time during program and erase * 20 us (at 10 MHz) 


Timer BO Used for BUSY waveform output time during serial | * Timer mode 
transmission/reception * 6 us (at 10 MHz) 
Used for wait time during verify 
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Flow of The Main Processing 


Figure 2.2.2 shows a flow of the main processing. 
After initializing the CPU, transfer the write control program to RAM. When transfer is finished, jump to 
RAM and execute the write control program from RAM. 


RAM transfer program on ROM Write control program on RAM 


( CPU programming mode) Ee ee sis 


Initial setting 2 


Initial setting 1 


Transfer to RAM Command reception 


[ID check completed ? 


Page program | | 
Erase all unlock blocks | | 
Clear status register | | 


Read status register 


ID check function | 


Version information output 


Set UARTO of initial setting 2 | | 


Figure 2.2.2 Flow of The Main Processing 
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Initialization 1 (CPU, Memory) 


The CPU and RAM and the peripheral functions used for programming flash memory are initialized. Figure 
2.2.3 shows a flow of CPU and memory initialization. To clear RAM, use of string instructions (e.g., 


SSTR.W) will prove effective. 


Initial setting 1 


Set ISP and SB 


Set 'H" to BUSY pin 


RAM clear 


Protect release 


Set system clock 
control register 


Set processor mode 
register 


Set protect 


Port 5 (P5: address 03E916) 
b4 


PTET TET | 


ike aii Set 'H' data 


Port 5 direction register (PD5: address 03EB16) 
b. 


La ee | 


Ueedieieedaiisciat Set output port 


RO <— Set initial value 

At <<— Set top address of RAM 

R3 [-—— =] <— Programing control program size /2+0 
After setting these registers, execute SSTR.W 


Protect register (PRCR: address 000A16) 


bi b0 


La 


L. System clock write enabled 
vases Processor mode register write enabled 


System clock control register 0 (CMO: address 000616) 


b7 b6 bS5 b4 b3 b2 bi bO 


BREE EEe 


a a aa CM16 and CM17 is enabled 


System clock control register 1(CM1: address 000716) 


b7 b6 bS b4 b3 b2 bi bO 


Dosoo000 


Ure oeeeeacoaseea esas No division mode 


Processor mode register 0(PMO: address 000416) 


b7 b6 bS b4 b3 b2 bi bO 


Processor mode register 1(PM1: address 000516) 


b7 b6 bS b4 b3 b2 bi bO 


| 1] of 0] of of of ofa] 


eens With wait 


Figure 2.2.3 Initialization 1 (CPU, Memory) 
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Transfer to RAM Area 


The write control program is transferred to RAM. After transferring, jump to write control program on RAM. 
To transfer, use of string instructions (SMOVF.W) will prove effective. 
Figure 2.2.4 shows the algorithm. 


Transfer to RAM 
Transfer version information 


Transfer preparing 


ROH[ _| <— Set source address (high-order 4 bits) 


AO [ ~<t— Set source address (low-order 16 bits) 
Al [| ~<— Set destination address 


R3 [ <t— Programing control program size /2+a 


Execute SMOVF.W 


Jump to RAM area 


JMP 


Figure 2.2.4 Transfer to RAM Area 


Initialization 2 


Set of write to Flash memory is executed. The flash mode register is set in M16C/20 group. 
Figure 2.2.5 shows a algorithm. 


Initial setting 2 


- Flash memory control register 0 (address 03B416) 
Set CPU rewrite mode b7 b6 bS b4 b3 b2 b1 b0 


acta oO | tfofol | fol 


' ee oe 1. CPU rewrite mode enabled 
b dgeterdas deacntsooces Reserved bit 


Flash memory control register 1 (address 03B516) 
b7 b6 bS b4 b3 b2 b1 b0 


Gotoinitialsetting of 122 es Reserved bit 
peripheral function 


Figure 2.2.5 Initialization 2 
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Initialization 2 (Peripheral Function) 


The peripheral functions used for programming to flash memory is initialized. Figure 2.2.6 shows initialization 
of UARTO for data transmit and timer AO and BO for time-out calculation. 


From initial setting 2 


Set UARTO 


UARTO transmit/receive mode register (UOMR: address 03A016) 


b7 b6 bS b4 b3 b2 bi b0 


| of of of of +] 0] of | 


| 4--4£--4-.Clock synchronous serial I/O mode 
Le dininiSinoe wicca External clock 


UARTO transmit/receive control register 0 (UO0CO: address 03A416) 


b7 b6 bS b4 b3 b2 bi b0 


| Of of of +] of 0] of] 


uote (il) 
EA dh acct Reserved bit 


See eee an eee TxD CMOS output 
Ladera cnceecdeeteiceead LSB first 


UART transmit/receive control register 1 (U0C1: address 03A516) 


b7 b6 bS b4 b3 b2 bi b0 


| of of of of of +] of] 


: ‘- Transfer enabled 
iii! Receive enabled 


UART transmit/receive control register 2 (UCON: address 03B016) 


b7 b6 bS b4 b3 b2 bi bO 


i oa oa 4. S=-+-.(Transfer buffer empty) 
sini erty ae (Continuous receive mode disabled) 


t Esterase soci CLKO clock output 
Dee ee eee eee ee ee eee CLK normal mode first 


Timer AO mode register (TAOMR: address 039616) 


b7 b6 bS b4 b3 b2 bi b0 


He en One-shot timer mode 
to beeeeeeee No pulse output 
Ledbbochdemche One-shot start flag is valid 


Timer AO register (TAO: address 038716,038616) 
#3000-1 <t— When 10Mkz, 300uUs 


Timer BO mode register (TBOMR: address 039B16) 


b7 b6 bS b4 b3 b2 bi b0 


: .--+-. Timer mode 


Timer BO register (TBO: address 0391 16,039016) 


#60-1 <t— When 10MHz, 6us 


Figure 2.2.6 Initialization 2 (Peripheral Function) 
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Receiving Commands 


Receive commands is received from the serial programmer. 
After a wait time of 300 us, write dummy data to the transmit buffer, pull the BUSY signal low, and wait for 
data from the serial programmer. After receiving data, return the BUSY signal back high and read the 


received data. 


Figure 2.2.7 shows a flow of control. Figure 2.2.8 shows BUSY signal control timing. 


Receiving commands 


Start one-shot timer 


300 US wait 


Write to transfer buffer 


Preparing 
register 


reception 


BUSY="L" output 


Receive buffer 
empty flag 


Reception a 


completed ? 


Jump to time-out 
processing 
Yes 


BUSY="H" output 


6 us timer start 


Read out receive 
buffer register 


Reception 
processing 


Figure 2.2.7 Receiving Commands 


CLK 


RxD 


Receive complete 
flag (RI) 


Interrupt request 
is happen 


BUSY (P53) 


Set 'H' 
(Preparation to read 
reception data) 


Set 'L' 
(Preparation 
to receive) 


Read out the 


UARTO transfer buffer register (03A316,03A216) 


(b15) (b8) 
b7 b0 b7 bO 


Port 5 b3 
FL LT Tet 
Port 5 


b3 
REREManE 


UARTO reception buffer register (03A716,03A616) 
(b15) (b8) 


bO b7 b0 


Interrupt request 
is happen 


Set 'L' 
(Preparation 
to receive) 


reception data --> Store in RAM 


Figure 2.2.8 BUSY Signal Control Timing 
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Page Read 


Read a specified page (256 bytes) in the user ROM area, one byte at a time, and transmit the read data via 
serial I/O. The locations to read are addresses xxx0016 through xxxFF16, with data sequentially transmitted 
beginning with address xxx0016. 

Receive two bytes of address from the serial programmer and store it in RAM. Write read command (0016) 
to the Flash Command Register, read data from flash memory one byte at a time, and transmit it via serial 
I/O. When you finished sending one page of data (256 bytes), terminate the processing. 

Figures 2.2.9 show processing flows. 


Page read 


Transfer/receive cycles 
r3=0 


Set low-order address, 
addr_|=0 


~~ 


Write to transmit buffer 
register 


Start one-shot timer 


Reception 
completed? 


Jump to time-out 
processing 


6 usec timer start 
Read the receive buffer 
register 
13>2 Store reception data to 
address buffer 
<I, 


Read data 13=2 
Write read command 
KASS t | [Litite read command || 


13=/258 


Figure 2.2.9 Page Read 
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Page Program 


Write data to the user ROM area in units of 256 bytes. The locations to write are addresses xxx0016 
through xxxFF16, with data sequentially received beginning with address xxx0016. 

Receive a total of 258 bytes of data, consisting of two bytes of address and 256 bytes of write data, from 
the serial programmer and store them in RAM. 

After receiving all of these data, check for error. 

If the CPU rewrite mode monitor flag is invalid (FCONO02 = 0), assume a program error (SRD4 = 1). When 
you received an invalid address, assume an address error (SRD8 = 1). If the flag is valid (FCONO2 = 1), 
write Program command (4016) to the Flash Command Register and execute an instruction that writes the 
address to be programmed and the byte data. 

After an elapse of 20 us, verify Program. 

Write Program Verify command (C016) to the Flash Command Register and after an elapse of 6 us, execute 
an instruction that reads the programmed address. If the read data matches the written data, program the 
next address. If the data do not match, execute Program and Program Verify operations over again. If the 
data still do not match after repeating this 25 times, assume a program error (SRD4 = 1). If an error is found 
after programming 256 bytes or by error determination, write Reset command (FF 16) to the Flash Command 
Register twice in succession. Then write Read command (0016) and return to the main routine. 

Figures 2.2.10 and 2.2.11 show processing flows. 


Page program 
Receive cycles r3=0 


Set low-order address, 
addr_l=0 


=a 


Write to transmit buffer 
register 


BUSY = "L" output 


Start one-shot timer 


Jump to time-out 
processing 


¥ 


BUSY = "H" output 


Read the receive buffer 
register 


Store the reception data 
to RAM 


r3=r3+1 


13=259 


Figure 2.2.10 Page Program (1) 
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OK 


Retry cycle r2=25 


Address error 
flag (SR8)=1 
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Address +1 
3 =13 +1 


N 
Retry cycle 
r2=0 ? 
AG 


N 
Retry cycle r2-1 


~—=a 


Program error 
flag (SR4)=1 


Set TAO= 300 usec 
Start one-shot timer 


Write reset command 
Write reset command 
Write read command 


End 


Figure 2.2.11 Page Program (2) 
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All Erase (Erase All Unlock Blocks) 


Erase the entire user ROM area of flash memory. 

If All Erase command is received from the serial programmer, continue and receive one more byte of data. 
After confirming that this second byte of data is the verify command, check for error. 

If the CPU rewrite mode monitor flag is invalid (FCONO02 = 0), assume an erase error (SRD5 = 1). If the flag 
is valid (FCONO2 = 1), write Program command (4016) to the Flash Command Register, set the start 
address F400016 and end address FFFFF16, set #0016 in the write data, and then execute an instruction to 
write the data. 

After an elapse of 20 us, verify Program. 

Write Program Verify command (C016) to the Flash Command Register and after an elapse of 6 us, execute 
an instruction that reads the programmed address. If the read data matches the written data, program the 
next address. If the data do not match, execute Program and Program Verify operations over again. If the 
data still do not match after repeating this 25 times, assume an erase error (SRD5 = 1). 

After you finished writing #0016 in the entire area, write Erase command (2016) to the Flash Command 
Register twice in succession. After an elapse of 20 ms, write Erase Verify command (A016) to the Flash 
Command Register and after an elapse of 6 us, execute an instruction that reads the erased address. If the 
read data matches #FF16, check the next address. If the data do not match, execute Erase and Erase 
Verify operations over again. If the data still do not match after repeating this 1000 times, assume an erase 
error (SRD5 = 1). 

If an error is found after erase is finished or by error determination, write Reset command (FF 16) to the 
Flash Command Register twice in succession. Then write Read command (0016) and return to the main 
routine. 

Figures 2.2.12 and 2.2.13 show processing flows. 
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Erase al | unlock block 


Write to transfer 
buffer register 


BUSY="L" output 


Start one-shot timer 


N 


Reception 
completed? 
Y 


BUSY = "H" output 


Jump to time-out 
processing 


Read the receive 
buffer register 


Confirm confirm NG 
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command 
OK 


Set erase start/stop 
address 


G 


Vpp=12V input ? s 


' 


ie} 
xR 


Set write data "00h" 


Retry cycle r2=25 


Stop TAO 
Set TAO=20 usec 


>< 
Write program 
command 


Write "00h" 


Start one-shot timer 
of TAO 


over 


Read data = 
"00h"? 


Y 
Set erase retry cycle 


Address + 1 


Figure 2.2.12 Erase All Unlock Block (1) 
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Address - 1 
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Retry cycle r2=1000 


Stop TAO 
Set TA0=300 usec 


<a 
Write all erase command 
Write all erase command 


Start one-shot timer of 


TAO 
~~ 
over 
Pe 


Write erase verify 
command 


N Start address ? 
y Address - 1 


Address - 1 y 


Set erase error flag 
<_ 


Write reset command 
Write reset command 
Write read command 


End 


Figure 2.2.13 Erase All Unlock Block (2) 
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Read Status Register 


Transmit two bytes of status data indicating the flash memory's operating status via serial I/O. 

Write status data (SRD) to the Transmit Buffer Register and transmit it. 

After you finished sending, write status register 1 (SRD1) to the Transmit Buffer Register and transmit it. 
After you finished sending, return to the main routine. 

Figure 2.2.14 shows a processing flow. 


Read status register 


Transfer/receive 
cycle r3=0 


ril=SRD 
rih=SRD1 


Transfer buffer 
register = rl 


Jump to time-out 
processing 


Y 
BUSY = "H" output 


Start 6 usec timer 


Read receive buffer 
register 


r3=13+1 


ril= rth 


Figure 2.2.14 Read Status Register 
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Clear Status Register 


Status register error information is cleared. 

#8016 is written into the status register (SRD). 

The logic sum for the status register 1 (SRD1) is obtained on #9C16 is cleared. Processing returns to the 
main part. 

Figure 2.2.15 shows a processing flow. 


Clear status register 


Clear SRD error flag 


Clear SRD1 error flag 


Figure 2.2.15 Clear Status Register 


ID Check 


The ID data stored in the flash memory is compared with the data received by serial I/O. Three bytes of the 
address data, one byte of ID size and some bytes of ID check data are received via serial I/O. 

After these data reception, this process judges whether the flash memory is blank or not. When blank, the 
ID check is ended and processing returns to the main part. When something is written in the ROM, the 
received ID address, the ID data size and ID data contents are checked. When mismatch, ID check error 
is generated (SR10 = 1, SR11 = 0) and processing returns to the main part. When match, the ID check is 
ended (SR10 = 1, SR11 = 1) and processing returns to the main part. 

Figure 2.2.16 shows a processing flow. 
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ID check 


Transfer/receive 
cycles r3=0 


Set ID size (a1) 
temporar 


— 
S=a1——*3=ID size(al)? 
r3=/al 


Write transfer buffer 
register 


6 usec wait 


BUSY="L" output 


Start one-shot timer 


Reception 
completed? 


Jump to time-out 
processing 


BUSY = "H" output 
Start 6 usec timer 


Read the receive 
buffer register 


Store receive data 
into RAM 


r3=4 


al <-- ID size+4 


Blank Blank flag ? 


Non blank 


Error 


OK 
ID check cycles r3=1 


= 


Read ID data from 
Flash memory 


ID mismatch 


SR11=0, SR10=1 


ID check completed 
SR11=1, SR10=1 
Error cycle=0 


Figure 2.2.16 ID Check 
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Version Information Output 


The version information of boot program is sent via serial I/O. 
Version information is read and written in the transmit buffer register. 
After all version information is send, processing jumps to main . 
Figure 2.2.17 shows a processing flow. 


Version information output 


Transfer/receive 
cycles a0=0 


Write version 
information to transmit 
buffer register 


6 usec wait 


BUSY = "L" output 


Start one-shot timer 
~<a 


Jump to time-out 
processing 


a0<8 


Figure 2.2.17 Version Information Output 
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Time-Out Processing 


Time-out flag (SRQ) is set to 1 and initiale setting 2 of main routine is executed again. 
Figure 2.2.18 shows a processing flow. 


Time-out processing 


BUSY = "H" output 


Time-out flag 
(SR9)=1 


Initial setting 2 
UARTO setting 


End 


Figure 2.2.18 Time-Out Processing 
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Status Register (SRD) 


The status register indicates operating status of the flash memory and status such as whether an erase 
operation or a program ended successfully or in error. 
Table 2.2.2 shows the definition of each status register bit. 


Table 2.2.2 Status Register (SRD) 


Each bit of Definition 
Status name 


Status bit Ready Busy 


Reserved 


Erase bit Terminated in error | Terminated normally 


Program bit Terminated in error | Terminated normally 


Reserved 


Reserved 


Reserved 


Reserved 


State Bit (SR7) 
The status bit indicates the operating status of the flash memory. When power is turned on, "1" (ready) is 
set for it. 


Erase Bit (SR5) 
The erase bit indicates the operating status of the auto erase operation. If an erase error occurs, it is set 
to "1". When the erase status is cleared, it is set to "0". 


Program Status (SR4) 


The program status reports the operating status of the auto write operation. If a write error occurs, it is set 
to "1". When the program status is cleared, it is set to "0". 
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Status Register 1 (SRD1) 


Status register 1 indicates the status of serial communications, results from ID checks and results from 


check sum comparisons. 
Table 2.2.3 gives the definition of each status register 1 bit. "0016" is output when power is turned ON and 


the flag status is maintained even after the reset. 
Table 2.2.3 Status Register 1 (SRD1) 


Each bit of Definition 
SRD1 Status name 


Boot update completed bit Update completed Not update 


SR15 (bit7 
SR14 (bit6 


( 
( 
SR13 (bit5 
( 
( 
( 


Reserved 


) 

) 

) | Reserved 

SR12 (bit4) | Checksum match bit Match Mismatch 
) 
) 


SR11 (bit3 
SR10 (bit2 


ID check completed bits 00 Not verified 

01 Verification mismatch 
10 Reserved 

11 Verified 


SR9 (bit!) | Data receive time out Time out Normal operation 
SR8 (bit0) | Reserved 


Boot Update Completed Bit (SR15) 
This flag indicates whether the control program was downloaded to the RAM or not, using the download 


function. 


Checksum Match Bit (SR12) 
This flag indicates whether the check sum matches or not when a program, is downloaded for execution 


using the download function. 


ID Check Completed Bits (SR11 and SR10) 
These flags indicate the result of ID checks. Some commands cannot be accepted without an ID check. 


Data Reception Time Out (SR9) 
This flag indicates when a time out error is generated during data reception. If this flag is attached during 
data reception, the received data is discarded and the microcomputer returns to the command wait state. 
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2.3 Sample List 


This section shows a sample list of the program described in Section 2.2. 


M16C/20 Group 
2.3 Sample List 


In addition to the processing explained in Section 2.2, the sample shown below includes the programmer 
command processing used by a synchronous serial programmer and the command processing used by an 


asynchronous serial communication programmer (M16C Flash Start). 


Source 


PRR RRR RRR KK RK KKK KK KKK KKK KR KK RK KR KKK KEK KERR KEK KEK KK KK KEK KKK 


; System Name Sample Program for M16C/20 Flash 
; File Name : M201SAMP.a30 

; MCU : M30201F6 

; Xin ; 2MHz — 10MHz (for UART mode) 

; CPU ; lwait,f1l 

A Assembler AS30 ver 3.00 


Linker LN30 ver 3.00 


Copyright,1999 MITSUBISHI ELECTRIC CORPORATION 
AND MITSUBISHI SYSTEM LSI DESIGN CORPORATION 


a 


+ + F FF F F F F F F OF 
+ + F FF F F F F HF F 


i 
pttt++ttt Include file ++++++++t+t++++++tt+t+++++¢ttt+++¢t ttt 


, 


Last off 

. include sfr20.inc 

. include flash201l.inc 
-list on 


a 


ZEFLFFFTTTEFEFETT LEFT TLLFFFFETELFFFETTEFEFE ETT E +++ 44444 


7+ Version table + 
FEEEEEEEFHEEEFHEEEFHEEEFEEEFEEEFHEEEFEEEFEEEFEEEFEEEFEEEFEEET 
.section rom, code 
-org Version 
.byte "VER.0.02(VER.1.04)' 


; 

FEFEEEEEEEAFEEEEEEEEEPEFEEEFEEEEEEEFEEEEFEEEEEEPEEE EEE ET 
Hog Program section start + 
FEFEEEEEEFAFE FEE E EEE EEEEFFEEEEEEEEEEEFE EEE EEE EEE EEE ET 


-section prog, code 
.org Boot_TOP 
.sb SB_base 
.sbsym SRD 
.sbsym SRD1 
.sbsym ver 
.sbsym SF 

.sbsym addr_1l 
.sbsym addr_m 
.sbsym addr_h 


; 
PEEHEEEEEFEEEEEEEEEEEEEEEEEEEEEEEEEEFEEEEEEEEEFEEEEEEEP EET 
e+ Boot program start + 
PEEEEEEEEEEEEEEEEEEEEEEEEFEFEEEEEEEFEFEEEEEEEFEEEEEEEPE EET 
Reset: 


ldc #Istack, ISP ; stack pointer set 
ldc #SB_base, SB ; SB register set 
, 
mov.b #00000001b, pd5 ; TxD-output, BUSY/RxD/CLK-input 
mov.b #00000001b, p5 7 TxXD-"H"output 
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pt Hot start & RAM clear + 
r 
mov.w 0,a0 
Start_check: 
cmp .w 55aah, buff [a0] 
jne RAM clear 
add.w 2,a0 
cmp .w 18,a0 
jltu Start_check 
bset ram_check 7 RAM check OK flag set 
jmp CPU_set 
r 
RAM_clear: 
mov.w 0, £0 
mov.W (Ram_END+1-Ram_TOP) /2,r3 
mov.w Ram_TOP, al 
Sstriuw 
r 
mov.w 0,a0 
Buff_set: 
mov.w 55aah, buff [a0] 
add.w 2,a0 
cmp .w 18,a0 
jltu Buff_set 


jt CPU set & Serial I/O mode check + 


CPU_set: 
btst busy 
bmc s_mode 
bset busy ; BUSY-"H"output 
bset busy_d 
; 
jsr Initialize_1 


mov.b #80h, SRD 
and.b #9eh, SRD1 


bset sr7 ; RADY 
r 
Reload_chack: 
btst srl5 ; Update 
jc Transfer_end 
btst ram_check ; Reload ? 
jz Version_inf 
btst s_mode 
bxor old_mode 
jne Transfer_end 
; 
r 
pt Version information + 


’ 


Version_inf: 


mov.w #0,a0 ; ad=0 
Ver_loop: 
lde.w Version+9[a0],ver[a0] ; Version data store 
add.w #2,a0 ; address increment 
cmp .w #8,a0 ; a0=8 ? 
jltu Ver_loop 7 jump Ver_loop at a0<8 


’ 


FEEFFETTLLFFFTTLEFFFE TELL FFFETTEFFFETTTEFFETEPEFEE EET + +44 


i+ Program_transfer clock synchronous mode + 

FTE EETTEEEEEET EF EF FETE PEPE E TTP PPP P ttt ttt ttt t tt tet 
btst s_mode ; Serial I/O mode select 
jz Transfer2 ; UART mode 
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Transferl: 

bset old_mode ; clock synchronous mode 

mov.w #(Trans_TOP1 & Offffh),a0 

mov.b #(Trans_TOP1>> 16),rlih 

mov .w #Ram_progTOP,al 

mov.w #(Trans_END1- Trans_TOP1 + 1)/2,r3 

smovf.w ; String move 

jmp Transfer_end 
, 
FEFEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE EEE PEAT 
3+ Program_transfer UART mode + 
FEFEEEEEEEEEEEEEEFEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE EEE HH 
Transfer2: 

bole old_mode ; UART mode 


mov.w #(Trans_TOP2 & Offffh),a0 

mov.b #(Trans_TOP2>> 16),rlih 

mov .Ww #Ram_progTOP,al 

mov.w # (Trans_END2- Trans_TOP2 + 1)/2,r3 

smovf.w ; String move 
Transfer_end: 


a+ Jump to RAM + 


jmp Ram_progTOP 
, 
Fr ois a LL LO 
p+ Subroutine : Initialize_1 + 
Fr iss a i nL LD LL 
Initialize_1: 


yt Processor mode register + 
p+ & System clock control register + 
, 
mov.b #3,prcer ; Protect off 
mov.w #8000h, pm0 > lwait 
mov.w #2008h, cm0 ; £1 select 
mov.b #0,prer ; Protect on 
v 
r 
yt ID address & size store + 
v 
mov.w #0ffdfh, ID ; ID address Offfdfh store 
mov.w #0070fh, ID+2 ; ID size 7 store 
r 
rts 


, 


pEFLFFFTTTEFEFETTLEFEFETTLFFFFETTLFFFETTEEFFE TEP E FEE TH H+ 


7+ Subroutine : Download program + 
PEAEEEEEAAFEEAFEFEFAFEEAEEFEFAEEFEEFEAFFAEEEEHAAFFFEFP HPP AT 
.org Download_program 
, 
mov.w #0,xr3 ; receive number (r3=0) 
mov.w #0,al ; sumcheck buffer 
bolr srl5 ; Download flag reset 
belr srl12 ; Check sum flag reset 
Download_loop: 
mov.b rll, u0tb ; data transfer 
jsr wait_loop , BUSY "H" 6usec check 
belr busy $0 BLIGY «Wich 
bset ta0os ; 300usec start 
oe 
btst ir_taOic ; Time over check 
bmc srg ; Time over flag set 
bmc busy 7 (BUSY =" He 
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jc 
btst 
jz 
bset 
bset 
mov. 
add. 
cmp. 
jgtu 
mov. 
mov. 
mov. 
cmp. 
jne 
cmp. 
jz 
jmp 


’ 


Ww 
Ww 
Ww 


2.2.0 s 


= 


Version_inf 
ri_u0cl 

?- 

busy 

tb0s 

udrb, r0 

#1,4r3 

#3,4r3 
Version_store 
r3,a0 
r01l,addr_1[a0] 
#0,a0 

#3,4r3 
Download_loop 
#0,addr_m 
Version_inf 
Download_loop 


Version_store: 


cmp. 
jgtu 
mov. 
jmp 


’ 


WwW 


b 


#11,x3 
Program_store 
r0Ol,ver[a0] 
Program_store_1 


Program_store: 


mov. 


b 


r01,Ram_progTOP-8 [a0] 


Program_store_1: 


add. 
add. 
cmp. 
jltu 
jmp 


vr 


b 
Ww 
Ww 


rOl,al 

#1,a0 
addr_m, a0 
Download_loop 
SUM_Check 
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jump Version_inf at time out 
Receive complete ? 


BUSY "H" 

6usec timer start 

receive data --> r0 

r3+1 increment 

r3=3 ? 

jump Version_store at r3>3 
r3 --> a0 

Store program size 

a0 initialize 


r3 = 3? 
No, Download_loop 
program size = 0 ? 


jump to Version_inf at program size error 
jump Download_loop 


r3 = 11? 
jump Program_store at r3 > 11 
version data store to RAM 


; program data store to RAM 


add data to al 

a0 (download offset)+1 increment 

a0 = program size (addr_m,h)? 

jump Download_loop at a0< program size 
compare check sum 


PLEFFFTLLLFFFT ELLE EFE TELE FFFETTEFFFETE LEFT TE PEEFE EE +++ 44+ 


p+ Subroutine 


Download program 


UART + 


FEEAFFTTLLFFFTTLLFFFETELLFFFTETEFFFETE LEFT TET EFEF ETP ++ 4+ 


.org U_Download_program 
; 

mov.w #0,4r3 

mov.w #0,al 

bcelr sr15 

belr srl12 
U_Download_loop: 

bcelr busy 
28 

btst ri_u0dcl 

jne ?- 

bset busy 

mov.w udrb, r0 

add.w #1,xr3 

cmp.w #3,4r3 

jgtu U_Version_store 

mov.w r3,a0 

mov.b r01l,addr_1[a0] 

mov.w #0, a0 

cmp.w #3,4r3 

jne U_Download_loop 

cmp .w #0,addr_m 

jz Version_inf 

jmp U_Download_loop 


’ 


U_Version_store: 


cmp. 
jgtu 
mov. 


WwW 


b 


#11,xr3 
U_Program_store 
r0Ol,ver[a0] 


receive number (r3=0) 
sumcheck buffer 
Download flag reset 
Check sum flag reset 


BUSY "L" 


Receive complete ? 


BUSY "H" 

receive data --> r0 

r3+1 increment 

r3=3 ? 

jump Version_store at r3>3 
r3 --> a0 

Store program size 

a0 initialize 


r3 = 3? 
No, jump U_Download_loop 
program size = 0 ? 


jump to Version_inf at program size error 
jump Download_loop 


r3 = 11? 
jump Program_store at r3 > 11 
version data store to RAM 
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jmp 


, 


U_Program_store_1 


U_Program_store: 
r01,Ram_progTOP-8 [a0] 
U_Program_store_1: 


mov.b 


add.b 
add.w 
cmp .w 
jltu 
SUM_Check 
mov .w 
cmp.b 
bmeq 
jne 
bset 
jmp 


r0Ol,al 

#1,a0 

addr_m, a0 
U_Download_loop 


al,r0O 

data, r0l 
sr12 
Version_inf 
sr15 
Ram_progTOP 


M16C/20 Group 
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7 program data store to RAM 


add data to al 

a0 (download offset)+1 increment 

a0 = program size (addr_m,h)? 

jump Download_loop at a0< program size 


compare check sum 

check sum flag set at data=r0l 

jump Version_inf at check sum error 
Download flag set 

jump Ram_progTOP 


;+ Transfer 


(1) 
(2) 


(3) 


Program -- clock synchronous serial I/O mode + 


Main flow 


Flash control program 


Read, Program, |! 
Other program 


ID_check, Download, Version_output etc. 


Erase,All_erase,etc. 


+++ +t 


Trans_TOP1: 
PHEAFFFEFHEFELTFEFFFFFHEEEFFE THEE EFTHEFFFETEEEFEF ESE HEE EET 


ak main program 
Foi ss Ss is LS RC RL LR OL 


Main: 
aioe 


Loop_main: 


bset 
mov.b 


btst 
jz 
mov.b 
mov.b 
mov.b 
belr 


btst 
jz 
bset 


btst 
jc 
btst 
jz 
bset 
mov.b 
bset 
mov. 
mov. 
mov. 
and. 
cmp. 
jne 


OOO 2S 


Command_check: 


cmp.b 
jeq 
cmp.b 
jeq 
cmp.b 


Initialize_2 


ta0os 
#0,ta0ic 


ir_taOic 
?- 
#0,ta0ic 
#0ffh,r11 
r11,u0tb 
busy 


ti_u0cl 
ip Jes 


ta0os 


ir_ta0Oic 
Time_out 
ri_u0cl 
2?- 

busy 
0,tb0ic 
tb0s 
0,ta0ic 
u0rb, r0 
Och, rOh 
SRD1,r0h 
Och, rOh 
Command_check_2 


Offh, rO0l 
Read 
041h,r01 
Program 
020h, r0l 


, 


+ 


Initialize_2 


300usec timer start 


300usec? 


Interrupt request bit clear 
#f£fh --> rll (transfer data); 
dummy data --> transfer buffer 
BUSY "L" 


Transmit buffer empty ? 
300E sec timer start 
300E sec ? 


jump Time_out at time out 
receive complete ? 


BUSY "H" 


6usec timer start 

Interrupt request bit clear 

receive data > r0 

#00001100b srl10,11 mask data 
sr10,11 pick up 

ID check OK? 

jump Command_check_2 at ID uncheck 


Read (f£f£h) 
Program (41h) 
Erase (20h) 
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jeq Erase 
cmp.b #0a7h, r0l All erase (a7h) 
jeq All_erase 
cmp.b #050h, r01 Clear SRD (50h) 
jeg Clear_SRD 
cmp.b #071h, r01 Read RBS (71h) 
jeq Read_RB 
cmp.b OF Thy ToL RB program (77h) 
jeq Program_RB 
cmp .b O7ah, r0l RB enable (7ah) 
jeq Loop_main 
cmp .b O7 Shy FOL RB disable (75h) 
jeq Loop_main 
cmp.b #O0fah,r0l Download (fah) 
jeq Download 
cmp.b #0fch,r01l Boot output (fch) 
jeq Boot_output 

Command_check_2: 
cmp.b #070h, r01 Read SRD (70h) 
jeq Read_SRD 
cmp.b #0£5h, r0l ID check (£5h) 
jeq ID_check 
cmp.b #0fbh, r0l Version out (fbh) 
eq Ver_output 

Command_err: 
jsr Initialize 21 Command error,UART reset 
jmp Loop_main 

; 

r 

it Read / Boot output + 


, 
Boot_output: 
bcelr 

Read: 
mov.w 
mov.b 

Read_loop: 
mov.b 
jsr 
bcelr 
bset 


btst 
jc 
btst 
jz 
bse 
bse 
mov.Ww 
add.w 
cmp .w 
jgtu 
mov.W 
mov.b 
cmp .w 
jltu 
mov.W 
mov.b 
mov.b 
Read_data: 
lde.b 
add.w 
cmp .w 
jne 
Read_end: 


Ln 


fcon00 


#0,4r3 
#0,addr_1 


r11,u0tb 
wait_loop 
busy 
ta0os 


ir_taOic 
Time_out 
ri_u0cl 
?- 

busy 

tb0s 
vor; £0 
#1,4r3 
#2,403 
Read_data 
r3,a0 
r01l,addr_1[a0] 
#2,4r3 
Read_loop 
addr_1,a0 
addr_h,al 
00h, fcmd 


ala0O],rl1l 
1,a0 
258,xr3 
Read_loop 


not CPU write mode 


receive number (r3=0) 
addr_l = 0 


data transfer 
BUSY"H" 6usec check 
BUSY "L" 

300usec start 


Time over check 
jump Time_out at time out 
Receive complete ? 


BUSY "H" 

6usec timer start 
receive data --> r0 
r3+1 increment 

63; = 20°? 

jump Read_data at r3>2 
r3 --> a0 

Store address 

63° H".2 2 

jump Read_loop at r3<2 
addr_l,m --> a0 

addr_h --—> al 

Read command 


Flash memory read 

a0+1 increment 

x3 = 258 ? 

jump Read_loop at r3<258 
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bset fcon0dod CPU write mode 
jmp Loop_main jump Loop_main 
v 
, 
7+ Program + 
, 
Program: 
mov.w #1,4r3 receive number (r3=1) 
mov.b #0,addr_1 addr_l = 0 
Program_loop: 
mov.b r11,u0tb data transfer 
jsr wait_loop BUSY "H" 6usec check 
bcelr busy BUSY "L" 
bset ta0os 300usec start 
28 
btst ir_taOic Time over check 
jc Time_out jump Time_out at time out 
btst ri_u0cl Receive complete ? 
jz Pies 
bset busy BUSY "H" 
bset tb0s 6usec timer start 
mov.w u0rb, r0 receive data > r0 
mov.w r3,a0 r3 --> a0 
mov.b r01,addr_1[a0] Store address 
add.w #1,xr3 r3+1 increment 
cmp .w #259,4r3 r3 = 259 ? 
jltu Program_loop jump Program_loop at r3<259 
btst fcon02 Vpp 12V input ? 
jz Program_err 
mov.w #0,4r3 writing number (r3=0) 


Address_check: 


mov .w 
cmp .w 
jltu 
cmp .w 
jltu 

Address_err: 
bset 
jmp 


addr_m, a0 
#0£40h, a0 
Address_err 
#1000h, a0 
Program_loop2 


sr8 
Program_end 


Program_loop2: 


mov.w 
mov.b 
mov .w 
mov.b 
mov.w 
bcelr 
mov .w 
Byte_loop: 
mov.b 
ste.b 
bset 


btst 
jz 
mov.b 
mov.b 
IS 
lde.b 
cmp.b 
jeq 
sbjnz.w 
Program_err: 
bset 
jmp 


r3,a0 
data[a0],r0l 
addr_1,a0 
addr_h,al 


#25,4r2 
ta0os 
#200-1,ta0 


#40h, fomd 
r0l1, [ala0] 
ta0os 


ir_taQic 
?- 

0,ta0ic 
OcOh, fcmd 
wait_6usec 
ala0O],r0Oh 
r01l,r0h 
Byte_end 


sxr4 
Program_end 


1,r2,Byte_loop 


addr_m,h --> a0 
compare £4000h 
jump Address_err 
compare 100000h 
jump Program_loop2 


at < £4000h 


address error 
jump Program_end at address error 


3 --> a0 
data --> r0l 
addr_l,m --> a0 
addr_h --—> al 


retry number 
timer stop 
20usec timer set 


Program command 
data write 
20usec timer start 


Verify command 

wait 6usec 

data read 

compare write and read data 
when equal, jump to Byte_end 
to Byte_loop 


error flag set 
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Byte_end: 
add.w #1,addr_1l 
add.w #1,xr3 


M16C/20 Group 
2.3 Sample List 


address increment 
write number increment 


256 times writing ? 
jump Program_loop2 at r3<256 


300 usec set 
reset command 


Read command 


jump Loop_main 


cmp .w 256,23 
jltu Program_loop2 

Program_end: 
mov.w 3000-1,ta0 
mov.b Offh, fomd 
mov.b Offh, fcomd 
mov.b 00h, fcemd 
jmp Loop_main 

; 

; 

7+ All erase 


r 
All_erase: 
mov.b r11,u0tb 


jsr wait_loop 
bcelr busy 
bset ta0os 
28 
btst ir_taOic 
jc Time_out 
btst ri_u0cl 
jz 2s 
bset busy 
mov.w u0rb, r0 
cmp.b #0d0h, r0l 
jne Erase_err 
r 
mov.w #4000h, a0 
mov.w Ofh,al 
mov.w a0,data 
mov.w Offffh, addr_1 


Zero_clear: 


btst fcon02 
jz Erase_err 
mov.b #00h, r0l 
mov.w Zi, CZ 
bcelr ta0os 
mov.w 200-1,ta0 
Zero_clearl: 
mov.b 40h, fcmd 
ste.b r0l, [ala0] 
bset ta0os 
28 
btst ir_taOic 
jz °2= 
mov.b 0,ta0ic 
mov.b #0c0Oh, fcmd 
jsr wait_6usec 


lde.b ala0],r0h 

cmp.b r01,r0h 

jeq Zero_clear2 
sbjnz.w #1,r2,Zero_clearl 


jmp Erase_err 
Zero_clear2: 

mov.W #25,4r2 

cmp .w addr_1,a0 


jeq Erase_verify 
add.w 1,a0 
jmp Zero_clearl 


’ 


Erase_verify: 


data transfer 


BUSY "H" 6sec check 


BUSY "L" 


300usec start 


Time over check 
jump Time_out at time out 
Receive complete ? 


BUSY "H" 


receive data --> r0 
Confirm command check 
jump Erase_end at Confirm command error 


start address f£4000h 


end address fffffh 


Vpp 12V input ? 


write data 


retry counter 


timer stop 
20usec set 


"OOh" 


Program command 


"OOh" write 


20usec timer start 


program verify command 


wait 6usec 
data read 


compare writ 


and read data 


when equal 


r 


jump to Zero_clear2 


to Zero_clearl 
jump to Erase_err 


retry counter 
end address ? 


jump to Erase_verify 
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mov.w 1000, r2 
bcelr ta0os 
mov.w 3000-1,ta0 
Erase_verify2: 
mov.b 20h, fcemd 
mov.b 20h, fcemd 
mov.b 0,ta0ic 
mov.w O,rl 
bset ta0os 
ran 
btst ir_taOic 
jz 2 
add.b #1,r11 
cmp.b #66,r11 
jeq 2+ 
mov.b #0,ta0ic 
bset ta0os 
jmp o> 


23 


mov.b 
jsr 
lde.b 
cmp.b 
jeq 
sbjnz.w 
jmp 


cmp .w 
jeq 
sub.w 
jmp 

Erase_err: 

bset 

Erase_end: 
mov.b 
mov.b 
mov.b 


jmp 


, 


Erase_verify4: 


Erase_verify3: 


Oa0h, fcmd 
wait_6usec 
[ala0O],r0Oh 
Offh,rOh 


Erase_err 


data, a0 


Erase_end 
1,a0 


sxr5 


#0ffh, fomd 
#O0ffh, fomd 
#00h, fcomd 
Loop_main 


Erase_verify4 
1,r2,Erase_verify2 


Erase_verify3 
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retry 1000 times 
timer stop 
300usec set 


Auto erase command 
Auto erase command 


300usec timer start 


20msec ? 


erase verify command 

wait 6usec 

data read 

“fEh™ 2 

when equal , jump to Erase_verify2 
to Erase_verify 

jump to Erase_err 


start address ? 
jump to Erase_end 


erase error flag set 


reset command 


read command 
jump Loop_main 


, 


: Read SRD 


v 

Read_SRD: 
mov.W 
mov.b 
mov.b 


, 


#0,4r3 
SRD,r1il 
SRD1,rih 


Read_SRD_loop: 


mov.b 
jsr 
belr 
bset 


btst 
jc 
btst 
jz 

bse 
bse 
mov. 
add. 
mov. 
cmp. 
jne 


zoe sez 


r11,u0tb 
wait_loop 
busy 
ta0os 


ir_taOic 
Time_out 
ri_u0cl 
2?- 

busy 
tb0s 
u0rb, r0 
#1,4r3 
rlh, rll 
#2,03 


Read_SRD_loop 


data transfer 

BUSY "H" 6usec check 
BUSY "L" 

300usec start 


Time over check 
jump Time_out at time out 
Receive complete ? 


BUSY "H" 
6usec timer start 
receive data > r0 
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Read_SRD_end: 


jmp Loop_main 
, 
r 
p+ Clear SRD + 
r 
Clear_SRD: 
mov.b #80h, SRD ; SRD clear 
and.b #9ch, SRD1 ; SRD1 clear 
jmp Loop_main 
, 
r 
p+ Block Erase / Read Rock Bit + 
pt / Program Rock Bit (dummy) + 
r 
Erase: 
Read_RB: 
Program_RB: 
mov.w #0,xr3 


mov.b #0ffh,r11 
Read_RB_loop: 


mov.b ril,uwotb ; data transfer 
jsr wait_loop ; BUSY "H" 6usec check 
belky busy + BUSY UL" 
bset ta0os ; 300usec start 

a8 
btst ir_ta0Oic ; Time over check 
jc Time_out 7 jump Time_out at time out 
btst ri_u0cl ; Receive complete ? 
jz 25 
bset busy 7 BUSY "H" 
bset tb0s ; 6usec timer start 
mov.w udrb, r0 ; receive data --> r0 


add.w #1,xr3 
cmp.w #3,4r3 


jltu Read_RB_loop 
Read_RB_end: 
jmp Loop_main 
Fi 
r 
: ID check 
r 
ID_check: 
mov.w #0,4r3 ; receive number (r3=0) 
mov.w #0ffh,al ; ID size (dummy data = ffh) 
ID_data_store: 
cmp .w al,xr3 ; v3=al(ID size) 
jeq ID_address_check ; jump ID_address_check at r3=ID size 
mov.b r11,u0tb ; data transfer 
jsr wait_loop 7 BUSY "H" 6usec check 
belr busy . BUSY “L® 
bset ta0os ; 300usec start 
2S 
btst ir_ta0Oic ; Time over check 
jc Time_out 7 jump Time_out at time out 
btst ri Boel ; Receive complete ? 
jz el 
bset busy ;. BUSY ~ "HH" 
bset tb0s ; 6usec timer start 
mov.w udrb, r0 ; receive data --> r0 
mov.w r3,a0 £ 7S ==> 40 
mov.b r01l,addr_1[a0] ; Store address 
add.w #1,xr3 ; r3+1 increment 
cmp .w #4,4r3 ; v3=4 ? 
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jne ID_data_store jump ID_data_store at r3 not= 4 
mov.b data,al ID size --> al 
add.w 4,al al=al1+4 
jmp ID_data_store jump ID_data_store 
ID_address_check: 
btst blank blank flag check 
ake ID_check_end jump ID_check_end at blank 
cmp .w Offdfh, addr_1l lower ID address check 
jne ID_error jump ID_error at ID address error 
cmp .w 0070fh, addr_h higher ID address check 
jne ID_error jump ID_error at ID address error 
ID_data_check: 
mov.W 0000fh,al ID higher address --> al 
mov.w Offdfh,rl ID lower address --> rl 
mov.w Ly tS check loop number (r3=1) 
ID_check_loop: 
mov.w r1l,a0 rl --> a0 
lde.b fala0],r0l ID data read from Flash memory 
mov.w r3,a0 r3 --> a0 
cmp.b r01,data[a0] compare ID data 
jne ID_error jump ID_error at ID error 
add.w 4,r1 rl+4 increment (next ID address) 
cmp.w Offe7h,rl rl=O0ffefh ? 
jne P+ jump ? at not equal 
mov.W Offebh, rl rl=0ffeb at equal 
2. 
add.w 1,4r3 r3 +1 increment 
cmp .w Syr3 r3=8 ? 
jltu ID_check_loop jump ID_check_loop at r3<8 
ID_OK: 
bset sr10 
bset srll ID check OK (sr11=1,sr10=1) 
jmp ID_check_end jump ID_check_end 
ID error? 
bset sr10 
belr srll ID error (srl11=0,srl10=1) 
ID_check_end: 
jmp Loop_main jump Loop_main 
v 
, 
; Download 
, 
Download: 
bcelr fcon0do not CPU write mode 


jmp.a Download_program 


jump Download_program 


p+ Version output 


v 
Ver_output: 

mov.w #0, a0 
Ver_output_loop: 

lde.b ver[a0],r11l 

mov.b rl1,u0tb 


jsr wait_loop 
bclr busy 
bset ta0os 

ee 
btst ir_taOic 
ake Time_out 
btst ri_u0cl 
jz fi 
bset busy 
bset tb0s 
mov.w u0rb, r0 


data transfer 

BUSY "H" 6usec check 
BUSY "L" 

300usec start 


Time over check 
jump Time_out at time out 
Receive complete ? 


BUSY "H" 
6usec timer start 
receive data > r0 
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add.w #1,a0 
cmp .w #8,a0 
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jltu Ver_output_loop 
Ver_output_end: 
jmp Loop_main 
; 
; 
i+ 6usec timer wait 4 


’ 


wait_6usec: 


bset tb0s 
wait_loop: 

btst ir_tb0Oic 

jz wait_loop 


belr tb0s 
mov.b #0,tbO0ic 
rts 


’ 


FEET FT LEFT T TL FFFFETTLEFFFT TLL FFFE TELE FFFETTPEFFF EE ++ 444+ 


pt Subroutine : Initialize _2 


+ 


FFEFFFTT LEFT FHTLEFFFETTLEFFFETTLEFFETELEFFFETEPEFEE EE + +444 


Initialize_2: 


bset fcon00 
bset fcon05 
bcelr fcon04 
lde.w Offffch, r0 
lde.w Offffeh,rl 
and.w r1,xr0 
cmp.w #0ffffh, r0 
jne Blank_check_end 
bset sr10 

bset sril 

bset blank 


Blank_check_end: 


’ 


CPU write mode 
F4000h-FFFFFh select 


Reset vector read --> r0 

Reset vector read --> rl 

r0 & rl 

Blank check 

jump Blank_check_end at Blank error 
check complete 


blank flag set 


’ 


ae UARTO 


’ 


Initialize 21: 


fase Se UARTO transmit/receive mode register 


mov.b #0,u0cl1 
mov.b #0,u0mr 
mov.b #0,u0C0 


mov.b #00001001b, uOmr 


UARTO reset 


clock synchronous SI/O 


xternal clock 
fixed 


0 
| |++ 
| 
+ 


f1 select 

RTS select 

CTS/RTS enabled 
CMOS output (TxD) 
falling edge select 
LSB first 


taeSe= UART transmit/receive control register 2 


mov.b #00000000b, ucon 


Transmit buffer empty 
Continuous receive mode disabled 
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i | | ++ CLK/CLKS normal 
; [+ CTS/RTS shared 
; + fixed 
, 
| omnes UARTO transmit/receive control register 1 
, 
mov.b #00000101b, u0cl 
Hy || || | +------------ Transmission enabled 
; I} || + Reception enabled 
; +4+4+4+4+ fixed 
v 
, 
p+ Timer + 
, 
mov.b 02h,ta0mr ; £1 select,one-shot mode 
mov.b 0,ta0ic , Interrupt flag clear 
mov.w 3000-1,ta0 ; 300usec at 10 MHz 
bset ta0s 
, 
mov.b 00h, tbOmr ; £1 select 
mov.w 60-1,t50 ; 6usec at 10 MHz 
r 
ris 
v 
r 
p+ Time_out + 
, 
Time_out: 
bset busy ; BUSY "H" 
bset srg ; SRD1 time out flag set 
jmp Command_err 7 jump Command_err at time out 


Trans_END1: 


Transfer 


(1) 
(2) 


(3) 


Program -- UART mode 


Main flow 


Flash control program 
Read, Program, All_erase, Read_SRD, Clear_SRD 


Other program 
ID_check 


++ te eet 


~ 


Trans_TOP2: 


pFTEFFFTFTEFEFETTLEFEFETLLFFFFETLEFEFETTFEFFFE TPE FEET HE H+ 


+ 


ZEFLFFHTTLEFEFETELEFEFETLLFFFFTTELEFFTTTEFEFFE EP EF EHH TH H+ 


e+ main program 
U_Main: 
bcelr freq_set0O 
belr freq_setl 
belr freq_set2 
mov.b #64,data 
jsr U_Initialize 2 
bset re_u0cl 
bclr busy 
a8 
btst ri_u0cl 
IZ a= 
bset busy 
mov.w u0rb, r0 
cmp.b #0b0h, r01 
jne U_Freq_Get 
, 
(sass 10MHz 


a 


freq set flag clear 


9600bps for 10MHz 
Initialize _2 
Reception enabled 
BUSY "L" 


receive complete ? 


BUSY "H" 
receive data > r0 
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’ 


U_Freq_Get: 


’ 


’ 


U_Loop_main: 


’ 


mov. 
mov. 
mov. 
mov. 
mov. 
mov. 
bset 
jsr 

jmp 


mov. 
mov. 
mov. 
mov. 


OOO OS: 


b 


b 
b 
b 


#64,baud 
#32,baud+1 
#15, baud+2 
#10, baud+3 
baud, data 
data,u0brg 
freq_set0O 
U_BPS_BO 
U_Loop_main 


#80h, data 
#01000000b, rll 
#10000000b,r1h 
data, u0brg 


btst 
jne 


bcelr 


txept_u0c0O 
U_Loop_main 


te_u0cl 
re_u0cl 
busy 


sum_uO0rb 
U_RESET 


ri_u0dcl 

2?- 

busy 

u0rb;, r0 
freq_set2 
U_Command_check 
freq_set0O 
U_Freq_check 
#00h, r0l 
freq_set2 
U_Command_check 
freq_set0O 
#O0ffh,r01 
#01000000b, r11 
#10000000b,r1h 
#80h, data 
U_Freq_check 


U_Command_check: 


mov.b #0ch, r0h 
and.b SRD1,r0h 
cmp.b #0ch,r0h 
jne U_Command_check_2 
U_Command_check_1: 
cmp.b #0ffh, rOl 
jeq U_Read 
cmp.b #041h, r01 
jeq U_Program 
cmp.b #020h, r01l 
jeq U_Erase 
cmp.b #0a7h, rOl 
jeq U_All_erase 
cmp.b #050h, r0l 
jeq U_Clear_SRD 
cmp.b #071h,r01 
jeq U_Read_RB 
cmp.b #077h, rOl 


’ 


M16C/20 Group 
2.3 Sample List 


9600bps 

19200bps 
38400bps 
57600bps 


Transmission late 
"BOh" get flag set 


counbterl1,2 reset 


Transmission late 


Transmit register empty ? 


Transmission disabled 
Reception enabled 
BUSY "L" 


Error sum flag check 


receive complete ? 


BUSY "H" 

receive data --> r0 

freq fixed ? 

jump Command_check_2 at data 


jump U_Freq_check 
"00h" get? 


jump U_Freq_check 


dummy data set 
counbterl1,2 reset 


#00001100b srl10,11 mask data 
sr10,11 pick up 

ID check OK? 

jump Command_check_2 at ID uncheck 


Read (f£f£h) 
Program (41h) 
Erase (20h) 
All erase (a7h) 
Clear SRD (50h) 
Read RBS (71h) 
RB program (77h) 
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jeq 

cmp. 
jeq 

cmp. 
jeq 
cmp 
jeq 
cmp 
jeq 


ie) 


-b 


U_Program_RB 
O7ah,r0Ol 
U_Loop_main 
075h,r01 
U_Loop_main 
Ofah, rOl 
U_Download 


Ofch, r0Ol 
U_Boot_output 


U_Command_check_2: 


cmp 
jeq 
cmp 
jeq 
cmp. 
jeq 
cmp. 
jeq 
cmp. 
jeq 
cmp. 
jeq 
cmp. 
jeq 


U_Command_err: 


-b 


-b 


070h, r0Ol 
U_Read_SRD 
Of5h, r01 
U_ID_check 
Ofbh, r0l 
U_Ver_output 
Ob0h, rOl 
U_BPS_BO 
Obih, r0Ol 
U_BPS_B1 
Ob2h, r01 
U_BPS_B2 
Ob3h, r0l 


U_BPS_B3 


M16C/20 Group 
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RB enable (7ah) 
RB disable (75h) 
Download (fah) 
Boot output (fch) 
Read SRD (70h) 
ID check (£5h) 
Version out (fbh) 


Baud rate 9600bp (b0Oh) 


Baud rate 19200bps (bi1h) 


Baud rate 38400bps (b2h) 


Baud rate 57600bps (b3h) 


jsr U_Initialize_21 command error,UART Initialize 
jmp U_Loop_main 
, 
U_RESET: 
mov.b #0,u0mr uOmr reset 
mov.b #00000101b, uOmr 
jmp U_Loop_bak 
, 
yt UART Read / Boot output + 
r 
U_Boot_output: 
bcelr fcon0do not CPU write mode 
U_Read: 
mov.W #0,4r3 receive number (r3=0) 
mov.b #0,addr_1 addr_l = 0 
U_Read_loop: 
bcelr busy BUSY "L" 
23 
btst ri_u0cl Receive complete ? 
jz 2 
bset busy BUSY "H" 
mov.w u0rb, r0 receive data > r0 
add.w #1,xr3 r3+1 increment 
cmp.w #2,3r3 r3 =2? 
jgtu U_Read_data 7 jump U_Read_data at r3>2 
mov.w r3,a0 r3 --> a0 
mov.b r01,addr_1 [a0] Store address 
cmp .w #2,43 r3 =2 >? 
Leu U_Read_loop 7 jump U_Read_loop at r3<2 
mov.w addr_1,a0 addr_l,m --> a0 
mov.b addr_h,al addr_h --> al 
mov.b #00h, fcomd Read command 
bcelr re_u0cl Reception disabled 
bset te_u0cl Transmission enabled 
U_Read_data: 
cmp .w #258,4r3 r3 = 258 ? 
jz U_Read_end jump U_Read_loop at r3=258 
lde.b {alaO],r1l Flash memory read 
mov.b r11,u0tb rll --> transmit buffer register 
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btst 
jne 
add.w 
add.w 
jmp 


U_Read_end: 


ti_udcl 

?- 

#1,a0 

#1,4r3 
U_Read_data 


M16C/20 Group 
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transmit buffer empty ? 


address increment 
counter increment 
7 jump Read_data 


bset fcon00 CPU write mode 
jmp U_Loop_main jump Loop_main 
; 
; 
i+ Program + 


’ 


U_Program: 


mov.w #1,4r3 
mov.b #0,addr_1 
U_Program_loop: 
bcelr busy 
os 
btst ri_u0cl 
jz Fee 
bset busy 
mov.w udrb, r0 
mov.w r3,a0 
mov.b r0l1l,addr_1[a0] 
add.w #1,4r3 
cmp .w #259,4r3 
jltu U_Program_loop 
btst fcon02 
jz U_Program_err 
mov.w #0,4r3 


U_Address_check: 


mov.W 
cmp .w 
jltu 
cmp .w 
jltu 


addr_m, a0 
#0£40h, a0 
U_Address_err 
#1000h, a0 
U_Program_loop2 


U_Address_err: 


bset 
jmp 


sr8 
U_Program_end 


U_Program_loop2: 


mov .Ww 
mov. 
mov. 
mov. 


ozo 


mov.w 
mov.w 

U_Byte_loop: 
mov.b 
ste.b 
bset 


btst 

jz 
mov.b 
mov.b 
jsr 
lde.b 
cmp.b 
jeq 
sbjnz.w 


r3,a0 
data[a0],r0l 
addr_1,a0 
addr_h,al 


#25,4r2 
#200-1,ta0 


#40h, fcomd 
r0l, [ala0] 
ta0os 


ir_taOic 

?- 

0,ta0ic 

#0c0h, fcemd 
U_wait_6usec 
ala0O],r0h 
r01,r0h 
U_Byte_end 
1,r2,U_Byte_loop 


U_Pregram_err: 


bset 


sr4 


receive number (r3=1) 
addr_l = 0 
BUSY "L" 


Receive complete ? 


BUSY "H" 

receive data --> r0 

r3 --> a0 

Store address 

r3+1 increment 

r3 = 259 ? 

jump Program_loop at r3<259 
Vpp 12V input ? 
writing number (r3=0) 

addr_m,h --> a0 

compare £4000h 

jump U_Address_err at < £4000h 
compare 100000h 

jump U_Program_loop2 


address error 
jump U_Program_end at address error 


r3 --> a0 
data --> r0l 
addr_l,m --> a0 
addr_h --—> al 


retry number 
20usec timer set 


Program command 
data write 
20usec timer start 


Verify command 

wait 6usec 

data read 

compare write and read data 
when equal, jump to Byte_end 
to Byte_loop 


error flag set 
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jmp 
U_Byte_end: 
add.w 
add.w 
cmp .w 
JLeEU 


U_Program_end 


1,addr_1l 
1,r3 
25.6753 


Offh, fcomd 


U_Program_loop2 
U_Program_end: 


address increment 
write number increment 


256 times writing ? 
jump Program_loop2 at r3<256 


mov.b reset command 
mov.b Offh, fcomd 
mov.b 00h, fcemd Read command 
jmp U_Loop_main jump Loop_main 
v 
, 
;t Erase Block Erase/ Rock Bit Program (dummy) 
, 
U_Erase: 


U_Program_RB: 


mov .w 


#1,4r3 


U_Erase_loop: 


receive number (r3=1) 
BUSY "L" 

Receive complete ? 
BUSY "H" 

receive data > x0 


r3 --> a0 


r3+1 increment 


r3 = 4? 


jump Erase_loop at r3<4 
jump U_Loop_main 


belr busy 
rah 
btst ri_u0cl 
jz ?- 
bset busy 
mov.w u0rb, r0 
mov.w r3,a0 
add.w #1,xr3 
cmp .w #4,x3 
jltu U_Erase_loop 
jmp U_Loop_main 
v 
, 
a All erase 


, 


U_All_erase: 


bclr 


btst 
jz 
bset 
mov.w 
cmp.b 
jne 


mov. 
mov. 
mov. 


= = = = 


mov. 


, 


busy 


ri_u0cl 
?- 

busy 
u0rb, r0 
#0d0h, r0l 


U_Erase_err 


#4000h, a0 
#0fh,al 
a0,data 


#0ffffh, addr_l 


U_Zero_clear: 


btst 
jz 
mov.b 
mov.W 
belr 
mov.W 


fcon02 


U_Erase_err 


#00h, rOl 
#25,4r2 
ta0os 
#200-1,ta0 


U_Zero_clearl: 


mov.b 
ste.b 
bset 


btst 
Zee 
mov.b 


#40h, fcomd 
r0l1, [ala0] 
ta0os 


ir_taOic 


#0,ta0ic 


BUSY "L" 


Receive complet 


BUSY "H" 


receive data > 


Confirm command check 


start address f£4000h 


? 


ro 


end address fffffh 


Vpp 12V input ? 


write data 


"OOh" 


retry counter 


timer stop 
20usec set 


Program command 


"OOh" write 


20usec timer start 
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jump Erase_end at Confirm command error 


mov.b #0c0h, fcmd ; 
jsr U_wait_6usec ; 
lde.b [ala0],r0Oh : 
cmp .b r01,r0h . 
jeq U_Zero_clear2 H 
sbjnz.w #1,r2,U_Zero_clearl ; 
jmp U_Erase_err : 
U_Zero_clear2: 
mov.w #25,2x2 ; 
cmp .w addr_1,a0 4 
jeq U_Erase_verify 4 
add.w #1,a0 
jmp U_Zero_clearl 
| EFrase_verify: 
mov.Ww #1000, r2 ; 
mov.w #3000-1,ta0 ; 
| EFrase_verify2: 
mov.b #20h, fcomd ; 
mov.b #20h, fomd ; 
mov.b #0,ta0ic 
mov.Ww #0,xr1 
bset tados ; 
btst ir_taOic 
jz ioe 
add.b #1,r11 
cmp.b #66,r11 ; 
jeq 2+ 
mov.b #0,ta0ic 
bset ta0os 
jmp a= 


’ 
’ 
’ 


’ 


U_Read_SRD: 


| EFrase_verify3: 


mov.b #0a0h, fcmd : 
jsr U_wait_6usec : 
lde.b [ala0],rOh : 
cmp.b #0ffh,rOh ; 
jeq U_Erase_verify4 : 
sbjnz.w #1,r2,U_Erase_verify2 
jmp U_Erase_err : 
Erase_verify4: 

cmp .w data, a0 : 
jeg U_Erase_end E 
sub.w 1,a0 

jmp U_Erase_verify3 


| Erase_err: 


M16C/20 Group 
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program verify command 

wait 6usec 

data read 

compare write and read data 

when equal , jump to Zero_clear2 
to Zero_clearl 

jump to Erase_err 


retry counter 
end address ? 
jump to Erase_verify 


retry 1000 times 
300u set 


Auto erase command 
Auto erase command 


300usec timer start 


20msec ? 


erase verify command 

wait 6usec 

data read 

S£th™ °? 

when equal , jump to Erase_verify2 
; to Erase_verify 


jump to Erase_err 


start address ? 
jump to Erase_end 


bset sr5 ; erase error flag set 
| EFrase_end: 
mov.b #0ffh, fomd ; reset command 
mov.b #0ffh, fcomd 
mov.b #00h, fcmd ; read command 
jmp U_Loop_main 7 jump Loop_main 
Read SRD + 


belr 
mov. 
mov. 
mov. 
bset 


Ww 
b 
b 


re_u0cl 
#0,4r3 
SRD, r1il 
SRD1,rih 
te_u0cl 


Reception disabled 


Transmission enable 
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U_Read_SRD_loop: 
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mov .b r1l1,u0tb rll --> transmit buffer register 
De 
btst ti_u0cl transmit buffer empty ? 
JZ ro 
add.w #1,xr3 
mov.b rlh,ril 
cmp .w #2,xr3 
jne U_Read_SRD_loop 
jmp U_Loop_main 
v 
, 
zt Clear SRD + 
, 
U_Clear_SRD: 
mov.b #80h, SRD SRD clear 
and.b #9ch, SRD1 SRD1 clear 
jmp U_Loop_main 
v 
, 
p+ Read Rock Bit (dummy) + 
, 
U_Read_RB: 
mov.w #0,4r3 
mov.b #0ffh,r11 
U_Read_RB_loop: 
bcelr busy BUSY "L" 
28 
btst ri_u0cl transmit buffer empty ? 
jz a= 
bset busy BUSY "H" 
mov.w u0rb, r0 receive data > r0 
add.w #1,4r3 r3+1 increment 
cmp .w #2,xr3 CaS "2? 
jltu U_Read_RB_loop jump U_Read_RB_loop at r3<2 
bcelr re_u0cl Reception disabled 
bset te_u0cl Transmission enabled 
mov.b r11,u0tb dummy --> Transmit buffer register 
2. 
btst ti_u0cl transmit buffer empty? 
jne a= 
jmp U_Loop_main 


, 


, 


. ID check 


, 


U_ID_check: 


mov.Ww #0,4r3 

mov.w #0ffh,al 
U_ID_data_store: 

cmp .w al, 63 

jeq U_ID_address_check 

bcelr busy 
oes 

btst ri_u0cl 

jz 25 

bset busy 

mov.w u0rb, r0 

mov.w r3,a0 

mov.b r01,addr_1[a0] 

add.w #1,xr3 

cmp .w #4,x3 

jne U_ID_data_store 


receive number (r3=0) 
ID size (dummy data = ffh) 


r3=al(ID size) 
jump ID_address_check at r3=ID size 


BUSY "L" 
Receive complete ? 
BUSY "H" 
receive data > r0 
r3 --> a0 


Store address 

r3+1 increment 

r3=4 ? 

jump ID_data_store at r3 not= 4 
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mov.b data,al ID size --> al 

add.w #4,al al=al+4 

jmp U_ID_data_store jump ID_data_store 
U_ID_address_check: 

btst blank blank flag check 

jc U_ID_check_end jump ID_check_end at blank 

cmp .w #0ffdfh, addr_l lower ID address check 

jne U_ID_error jump ID_error at ID address error 

cmp .w #0070fh, addr_h higher ID address check 

jne U_ID_error jump ID_error at ID address error 
U_ID_data_check: 

mov.w #0000fh,al ID higher address --> al 

mov.w #0ffdfh,r1 ID lower address --> rl 

mov.w #1,4r3 check loop number (r3=1) 
U_ID_check_loop: 

mov.w r1,a0 rl --> a0 

lde.b [ala0],r0l1 ID data read from Flash memory 

mov.w r3,a0 r3 --> a0 

cmp .b r01,data[a0] compare ID data 

jne U_ID_error ; jump ID_error at ID error 

add.w #4,xr1 r1+4 increment (next ID address) 

cmp .w #0ffe7h,r1 rl=O0ffefh ? 

jne 2+ jump ? at not equal 

mov.w #O0ffebh, rl rl=0ffeb at equal 
F. 

add.w #1, 73 r3 +1 increment 

cmp .w #8,4r3 r3=8 ? 

jltu U_ID_check_loop jump ID_check_loop at r3<8 
U_ID_OK: 

bset sxr10 

bset sril ID check OK (srl11=1,sr10=1) 

jmp U_ID_check_end jump ID_check_end 
U_ID error: 

bset sr10 

belly srll ID error (sr11=0,sr10=1) 
U_ID_check_end: 

jmp U_Loop_main jump Loop_main 
, 
i 
; Download 


U_Download: 
bcelr fcon00 
jmp.a U_Download_program 


not CPU write mode 
jump Download_program 


pt Version output 


’ 


U_Ver_output: 


mov.w #0, a0 
belr re_u0cl 
bset te_u0cl 


U_Ver_output_loop: 


Reception disabled 
Transmission enabled 


lde.b ver[a0],u0tb Version data transfer 
9. 
btst ti_udcl transmit buffer empty ? 
jz 2S 
add.w #1,a0 
cmp .w #8,a0 
jltu U_Ver_output_loop 
jmp U_Loop_main 
; 
; 
p+ Baud rate change - UART mode + 
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U_BPS_BO: 
mov.b 
jmp 
U_BPS_B1: 
mov.b 
jmp 
U_BPS_B2: 
mov.b 
jmp 
U_BPS_B3: 
mov.b 
U_BPS_SET: 
belr 
bset 
mov.b 


btst 
jne 


btst 
jne 
belr 
jsr 
jmp 


, 


baud, data 
U_BPS_SET 


baud+1, data 
U_BPS_SET 


baud+2,data 
U_BPS_SET 


baud+3,data 


re_u0cl 
te_u0cl 
r01,u0tb 


ti_u0cl 
?- 


txept_u0c0 
‘Dia. 


te_u0cl 


U_Initialize_20 


U_Loop_main 


Baud rate 9600bps 


Baud rate 19200bps 


Baud rate 38400bps 


Baud rate 57600bps 


Reception disabled 
Transmission enabled 
rll --> transmit buffer register 


transmit buffer empty ? 


Transmission disabled 
UART mode Initialize 
jump Loop_main 


ZEFLFFHTTTEFEFETTLFFEFE TELE FFFTTEEEFFETTEFEFETE PEEP EET +444 


pe Freq 


check 


— UART mode - 


+ 


pTFLAFHTTLLFAFETTLEFEFEETLFFFF TT EFEFFTETEFEFE TE PEFEP EEE +444 


U_Freq_check 
bcelr 
btst 
jc 


btst 
jc 
cmp.b 
jeq 
jmp 
U_Freq_check 
btst 
jz 
U_Freq_check 
or.b 
U_Freq_check 
xor.b 
mov. 
mov. 
rot. 
rot. 
rot. 


jmp 


Too oO 8 


v 
U_Freq_check 
btst 

ake 
bset 
cmp.b 
jeq 
xor.b 
mov.b 
U_Freq_check 
mov.b 
mov.b 


re_u0cl 
8,xr1 
U_Freq_check_4 


freq_setl 
U_Freq_check_1 
#00h, r0l 
U_Freq_check_3 
U_Freq_check_2 
pHs 
13,xr0 
U_Freq_check_3 
as 

rlh, rll 
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data,ril 
rll,data 
Pins Pu 
#-1,r11 
#-1,r1h 
#-1,r11 
U_Freq_check_6 


_4: 


freq_setl 
U_Freq_set_1 
freq_setl 
#00h, r0l 
U_Freq_check_5 
data,rih 
rlh,data 


bs 


data, datatl 
#01000000b, r11 


Reception disabled 


counter = 8 times 

"00h"? 

fer_ulrb 

rll = counterl or counter2 


Baud = Baud xor rll 
data set 


counter sift 


Min-Baud get ? 
Yes , finished 


moon"? 


Min Baud --> data+l 
counter reset 
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mov. 
mov. 


b 
b 


#10000000b,rlh 
#01111111b, data 


U_Freq_check_6: 


mov. 


btst 
jz 
jmp 


’ 


b 


data,u0brg 


po_l 


2?- 


U_Loop_main 


U_Freq_set_1: 


btst 
jz 

xOr. 
mov. 


b 
b 


13,r0 
U_Freq_set_2 
data,rih 
rlh,data 


U_Freq_set_2: 


bset 
mov. 
sub. 
shl. 
add. 


mov. 
shl. 
mov. 
shl. 
mov. 
mov. 
mov. 


divu.b 


mov. 
mov. 
mov. 
mov. 
jmp 


ToT OT COO 8 Too oF 


ToT Oo 


freq_set2 
datatl,rl1l 
data,ril 
#-1,r11 
data,ril 


r1l,baud 
#-1,r11 
r1l1,baud+1 
-1,r11 
rll1,baud+2 
baud, r0l 
0,r0Oh 

6 
r01,baud+3 
baud, data 
Ob0h, r0l 
data,u0brg 
U_BPS_SET 


’ 


’ 


’ 


Reset 


Transmission late 


fer_ulrd 


9600bps 
19200bps 


38400bps 


57600bps 


"BOh" set 
Transmission late 


6usec timer wait 


’ 


U_wait_6usec: 


bset 


btst 
jz 
belr 
mov. 
res 


’ 


Fits ris Sis Bis isis i i i i i Le 
y+ Subroutine 
Fle ris ois ois isis ie i i i i i 


b 


tb0s 


ir_tb0ic 
?- 

tbOs 
#0,tbO0ic 


U_Initialize 2: 


bset 
bset 
belr 
lde. 
lde. 
and. 
cmp. 
jne 

bset 
bset 
bset 


Zezezeés 


fcon00 
fcon05 
fcon04 
Offffch, r0 
Offffeh,rl 
r1,xr0 
#O0ffffh, r0 
U_Blank_check_end 
srl10 

sril 

blank 


U_Blank_check_end: 


’ 


U_Initialize 2 


CPU write mode 


F4000h-FFFFFh select 


Reset vector read --> r0 
Reset vector read --> rl 


rO & rl 
Blank check 


M16C/20 Group 
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jump Blank_check_end at Blank error 


check complete 


blank flag set 
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UARTO 


U_Initialize_20: 


j-s-S— UARTO init late generater 1 
mov.b data, u0brg ; Transmission late 
, 
U_Initialize_21: 
pec ses UARTO transmit/receive mode register 
, 
mov.b #0,u0mr ; uOmr reset 
mov.b #00000101b, uOmr 
7 |] | +++ SHSrP Tete S transfer data 8 bit long 
; I] | |+ Internal clock 
; || |+ one stop bit 
; | |+ parity disabled 
; |+ sleep mode deselected 
, 
oe UARTO transmit/receive control register 0 
, 
mov.b #00001000b, u0cO 
; II || J++ f1 select 
; || | [++ RTS select 
; || |+ CTIS/RTS enabled 
F | |+ CMOS output (TxD) 
; [+ falling edge select 
; + LSB first 
, 
poss s UART transmit/receive control register 2 
, 
mov.b #00000000b, ucon 
; I] ) [++ earn ame Transmit buffer empty 
; || | [++ Continuous receive mode disabled 
. | | ++ CLK/CLKS normal 
F [+ CTS/RTS shared 
; + fixed 
v 
pesos UART transmit/received control register 1 
, 
mov.b #00000000b, u0cl 
7 HLT dd d+ Sa Transmission disabled 
; I} |] |+ See Transmission enabled 
; I} tt |+ Reception disabled 
; I] | |+ Reception enabled 
; +4+4+ fixed 
, 
, 
pt Timer + 
, 
mov.b 02h,ta0mr ; £1 select,one-shot mode 
mov.b 0,ta0ic ; Interrupt flag clear 
mov.w 3000-1,ta0 ; 300usec at 10 MHz 
bset ta0s 
, 
mov.b 00h, tbOmr ; £1 select 
mov.w 60-1, t50 ; 6usec at 10 MHz 
, 
rts 


58 
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M16C/20 Group 


2.3 Sample List 


Header 


PRR RR RRR KKK KR KR KKK KKK KR KK KKK KEK KR KKK KKK KE KK KEK KE KK KKK KEK ER 


’ 


* 
* 
’ 
ox 
1 
ox 
* 
* 


1 
’ 
’ 


’ 


file name 


definition of M16C/20 Flash 


0.07 ( 1999-8-5) 


for Boot Ver 1.03 


KKK KKK KK KKK KKK KKK KKK KKK KKK KK KKK KKK KK KKK KKK KKK KKK KKK KKK 


* 
* 
* 
* 
* 
* 


1 


; BUSY output 


v 


busy -btequ 3,03E9h * po_3 
busy_d -btequ 3,03EBh = sodb-3 
; define of symbols 

Ram_TOP .equ 000400h 

Ram_END .equ O000bffh ; 
Istack -equ 000c00h - 
Version .equ OdfbfOh 

Boot_TOP .equ Odf000h 

Boot_END .equ Odffffh 

Vector .equ Offfdch 

SB_base .equ 000400h 
Ram_progTOP .equ 000600h 
Download_program .equ Odf100h 
U_Download_program .equ Odfla0Oh 


’ 


-section 


.org 


memory, data 

Ram_TOP 
-blkb alt 
-blkb 1 
-blkb 10 
-blkb 1 
-blkb 3 
-b1lkb 1 
-blkb 1 
-blkb lL 
-blkb 256 
-b1lkb ae 
-blkb 20 
-blkb 1 
-blkb 4 
-btequ 0,SRD 
-btequ 1,SRD 
-btequ 2,SRD 
-btequ 3,SRD 
-btequ 4,SRD 
-btequ 5,SRD 
-btequ 6,SRD 
-btequ 7,SRD 
-btequ 0,SRD1 
-btequ 1,SRD1 
-btequ 2,SRD1 
-btequ 3,SRD1 


Block status after program ( 
Program status ( 0=OK 1=ERR 


Erase status ( 0=OK 


Write state machine 
Block address error 
Time out ( O0O=OK 1=T 
ID collation 

(OO0= no check 01= 


1=ERR ) 


) 


0=OK 1= 


ea 
vs) 
vs) 


status ( O=BUSY 1=READY ) 


IME OUT ) 


rror 10= 


11= OK ) 
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sr12 

sr13 

sr14 

sr15 

, 
ram_check 
blank 
s_mode 
old_mode 
freq_set0O 
freq_setl 
freq_set2 


, 


-btequ 
-btequ 
-btequ 
-btequ 


.-btequ 
.-btequ 
-btequ 
-btequ 
-btequ 
-btequ 
-btequ 


, 


, 


Check sum ( O= error 1= ok ) 


Download flag 
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2.4 Precautions 


This section describes precautions to be observed when controlling the M16C/20's internal flash memory. 


Handling of Vpp Power Supply 


In addition to the operating Vcc power supply, the flash memory requires a high-voltage (12 V) Vpp power 
supply for program/erase operations. We recommend that the Vpp power supply be 12 V only when you 
need to program/erase the flash memory, and 0 V otherwise. 

When using the Vpp power supply, pay attention to the following: 


(1) Do not apply an overvoltage to the Vpp pin. If the flash memory's Vpp voltage exceeds the absolute 
maximum rated voltage of 14 V, the device may be damaged. 


(2) When turning the Vpp voltage on or off, make sure the Vcc power supply is turned on. Before accessing 
the device, wait until the power supply stabilizes after being turned on. 


(3) Set the current capacity of the Vpp power supply by considering the device's power consumption in the 
same way as for the Vcc power supply. The Vpp current (lpp) during programming/erasing reaches the 
maximum value when program or erase operation is executed internally in the device after entering the 
command. At this time, be careful that the Vpp voltage applied to the M16C/20 will not drop. 


(4) Connect a bypass capacitor to the Vpp power supply pin as close to the Vpp pin as possible, as for the 
Vcc power supply pin. To prevent a transient drop of the Vpp voltage in (3) above, connect a bypass 
capacitor as close to the Vpp pin as possible. Although the value of this bypass capacitor varies with the 
operating current, the appropriate value normally is 0.1 to 1 uF per device. 


(5) Do not enter a low signal to the WE pin while you are applying 12 V to the Vpp pin. If the WE input is 
pulled low while the Vpp pin has 12 V applied to it, the flash memory may receive the data pin status at 
that point in time as a command. Therefore, if the WE input is pulled low by noise or for other reasons 
while writing data, the flash memory may be erroneously programmed/erased. 
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Additional programming inhibited 


Additional programming means writing data to a byte again after once writing to it (the byte that passed 
verification). 

Additional programming causes a high voltage to be applied to memory cells of the flash memory repeatedly, 
which may result in reduced or lost margins for memory data cell readout or degraded data retention 
characteristics. 

Therefore, when programming the flash memory, be careful not to additionally write to the bytes that have 
passed test by Program Verify. However, an exception is that only when you wrote "0016" to all bytes of 
flash memory before erasing, you can additionally write data "0016" to each byte once. This is because 
writing "0016" to all bytes of flash memory before erasing is indispensable to prevent overerase. 

Table 2.4.1 shows inhibited additional programming and acceptable additional programming. 


Table 2.4.1 Inhibited Additional Programming and Acceptable Additional Programming 


Inhibited additional (1) Writing the same data to the verified bytes again. 
programming Example: Writing data 25 times per byte without verifying 
programmed data. 
(2) Writing new data to already programmed bytes without 


erasing them. 


Acceptable additional Writing "0016" to all bytes before erasing. 
programming 
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3.4 Precautions 


3.1 Outline of Hardware 


M16C/62 Group 
3.1 Outline of Hardware 


The M16C/62 group contains DINOR-type flash memory. 
This section shows hardware information about the M16C/62 group which we think is necessary to create a 


boot program. 


Internal Flash Memory Outline 


Table 3.1.1 shows the outline performance of M30624FG and M30624FGL of the M16C/62 group. 


Table 3.1.1. Outline Performance of M30624FG and M30624FGL 


Item 


Performance 


Power supply voltage 


5V version: 2.7V to 5.5 V 
(f(XIN)=16MHz, without wait, 4.2V to 5.5V, 
f(XIN)=10MHz, with one wait, 2.7V to 5.5V) 
3V version: 2.4V to 3.6 V 
(f(XIN)=10MHz, without wait, 2.7V to 3.6V, 
f(XIN)=7MHz, without wait, 2.4V to 3.6V) 


Program/erase voltage 


5V version: 4.2V to 5.5 V 
(f(XIN)=12.5MHz, with one wait, 
f(XIN)=6.25MHz, without wait) 


38V version: 2.7V to 3.6 V 
(f(XIN)=10MHz, with one wait, 
f(XIN)=6.25MHz, without wait) 


Flash memory operation mode 


Three modes (parallel I/O, standard serial I/O, CPU rewrite) 


| User ROM area 


Erase block 


See Figure 3.1.1 


division 


| Boot ROM area 


Program method 


One division (8 Kbytes) (Note) 


In units of pages (in units of 256 bytes) 


Erase method 


Collective erase/block erase 


Program/erase control method 


Program/erase control by software command 


Protect method 


Protected for each block by lock bit 


Number of commands 


8 commands 


Program/erase count 


100 times 


ROM code protect 


Parallel I/O and standard serial modes are supported. 


Note: The boot ROM area contains a standard serial I/O mode control program which is stored in it 
when shipped from the factory. This area can be erased and programmed in only parallel I/O 


mode. 
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Memory Map 


The user ROM of M30624FG has seven blocks as block 0 to block 6. Figure 3.1.1 shows the memory map. 


00000016 


0C000016 


User ROM area 


0C000016 


0D000016 


0E000016 


OF000016 


OF 800016 
OFA00016 


OFC00016 
OFFFFF16 


Figure 3.1.1 M30624FG memory Map 


Block 6 : 64K bytes 


Block 5 : 64K bytes 


Block 4 : 64K bytes 


Block 3 : 32K bytes 


Block 2 : 8K bytes 
Block 1 : 8K bytes 
Block 0 : 16K bytes 
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Note 1: The boot ROM area can be rewritten in 
only parallel input/output mode. (Access 
to any other areas is inhibited.) 

Note 2: To specify a block, use the maximum 
address in the block that is an even 
address. 


OFE00016 
OFFFFFi6 Boot ROM area 


M16C/62 Group 
3 3.1 Outline of Hardware 


Related Register Configuration 


Figure 3.1.2 shows related registers for making user boot program. 


Flash memory control register 0 
b7 b6 bS b4 b3 b2 bi b0 Symbol Address When reset 


XM Jol | TT FMRO 03B716 XX0000012 


sa ile 0: Busy (being written or erased) 0! x 
1: Ready 

Poh re a FMRO1 |CPU rewrite mode 0: Normal mode 

poroor oor or or awe. select bit (Note 1) (Software commands invalid) 

COE cde ce va 1: CPU rewrite mode 

rohor boat (Software commands acceptable) 


oe oe ie Lock bit disable bit 0: Block lock by lock bit data is 
Horr bt FMRO2 

i ae ar oh a ee een a (Note 2) enabled 

a 1: Block lock by lock bit data is 
foetihe ke am disabled 


foro 1 eet FMRO3_ | Flash memory reset bit | 0: Normal operation 
Poh ob (Note 3) 1: Reset 


sae Spt eee Must always be set to “O” 


User ROM area select bit (| 0: Boot ROM area is accessed 


i) ja) eRasea be eceeeane Note 4) (Effective in only | 1: User ROM area is accessed 
woes boot mode) 


Nothing is assigned. 
When write, set "0". When read, values are indeterminate. 


Note 1: For this bit to be set to “1”, the user needs to write a “0” and then a “1” to it in succession. 
When it is not this procedure, it is not enacted in “1”. This is necessary to ensure that no 
interrupt or DMA transfer will be executed during the interval. Use the control program 
except in the internal flash memory for write to this bit. 

Note 2: For this bit to be set to “1”, the user needs to write a “O” and then a “1” to it in succession 
when the CPU rewrite mode select bit = “1”. When it is not this procedure, it is not enacted in 
“1”. This is necessary to ensure that no interrupt or DMA transfer will be executed during the 
interval. 

Note 3: Effective only when the CPU rewrite mode select bit = 1. Set this bit to 0 subsequently after 
setting it to 1 (reset). 

Note 4: Use the control program except in the internal flash memory for write to this bit. 


Flash memory control register 1 


b7 b6 b5 b4 b3 b2 bi b0 Symbol Address When reset 


fofofolo] |ololo FMR1 03B616 XXXXOXXX2 


Must always be set to “O” |= 0] 
Flash memory power __| 0: Flash memory power supply is eo 


supply-OFF bit (Note) connected 


1: Flash memory power supply-off 


eee beet ee tenn nen ene nee Reserved bit Must always be set to “0” 


Note : For this bit to be set to “1”, the user needs to write a “O” and then a “1” to it in succession. 
When it is not this procedure, it is not enacted in “1”. This is necessary to ensure that no 
interrupt or DMA transfer will be executed during the interval. Use the control program except 
in the internal flash memory for write to this bit. 

During parallel I/O mode,programming,erase or read of flash memory is not controlled by this 
bit,only by external pins. 


Figure 3.1.2 Related Register Configuration 
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Flash Control Circuit 
The M16C/62's flash control circuit controls the block erase and page program operations performed on the 
internal flash memory. Operation modes are selected by entering software commands to the flash control 
circuit. The status shows the status of the flash control circuit, as well as the status of program and block 
erase operations performed by the flash control circuit. 
To enter commands to the flash control circuit, write the command to flash memory address. 


Software Commands 


Flash memory operations are selected by writing a software command to the flash control circuit. The 
table below lists the operations performed by software commands. 


Table 3.1.2 Software Command List 


First bus cycle Second bus cycle Third bus cycle 


Command Data Data Data 
Mode | Address (Do to D7) Mode | Address (Do to D7) Mode | Address (Do to D7) 


Read array i X (Note 6) 


Read status register i SRD (Note 2) 


Clear status register 


Page program (Note 3) i WAO (Note 3)) WDO (Note 3) 
Block erase i BA (Note 4) | D016 


Erase all unlock block i xX D016 


Lock bit program i BA D016 


Read lock bit status i BA De (Note 5) 


Note 1: When a software command is input, the high-order byte of data (Ds to D15) is ignored. 

Note 2: SRD = Status Register Data 

Note 3: WA = Write Address, WD = Write Data 
WA and WD must be set sequentially from 0016 to FE16 (byte address; however, an even address). The page size is 
256 bytes. 

Note 4: BA = Block Address (Enter the maximum address of each block that is an even address.) 

Note 5: De corresponds to the block lock status. Block not locked when De = 1, block locked when De = 0. 

Note 6: X denotes a given address in the user ROM area (that is an even address). 


Flash Memory Address 


The table below shows the flash memory capacity of each block (address space, number of pages) and 
the block addresses of each block. 


Table 3.1.3 Flash Memory Address 
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Read Array Command (FF 16) 


The read array mode is entered by writing the command code “FF ie” in the first bus cycle. When an even 
address to be read is input in one of the bus cycles that follow, the content of the specified address is read 
out at the data bus (DO—D15), 16 bits at a time. The read array mode is retained intact until another 
command is written. 


Read Status Register Command (7016) 


When the command code “7016” is written in the first bus cycle, the content of the status register is read out 
at the data bus (DO—D7) by a read in the second bus cycle. 
The status register is explained in the next section. 


Clear Status Register Command (5016) 


This command is used to clear the bits SR3 to 5 of the status register after they have been set. These bits 
indicate that operation has ended in an error. To use this command, write the command code “5016” in the 
first bus cycle. 


Page Program Command (4116) 


Page program allows for high-speed programming in units of 256 bytes. Page program operation starts 
when the command code “4116” is written in the first bus cycle. In the second bus cycle through the 129th 
bus cycle, the write data is sequentially written 16 bits at a time. At this time, the addresses A0-A7 need to 
be increased by 2 from “0016” to “FE16.” When the system finishes loading the data, it starts an auto write 
operation (data program and verify operation). 

Whether the auto write operation is completed can be confirmed by reading the status register or the flash 
memory control register 0. At the same time the auto write operation starts, the read status register mode 
is automatically entered. 

After the auto write operation is completed, the status register can be read out to know the result of the 
auto write operation. For details, refer to the section where the status register is detailed. 

The status register bit 7 (SR7) is set to 0 at the same time the auto write operation starts and is returned to 
1 upon completion of the auto write operation. In this case, the read status register mode remains active 
until the Read Array command (FF 16) or Read Lock Bit Status command (7116) is written or the flash 
memory is reset using its reset bit. 

The RY/BY status flag of the flash memory control register 0 is 0 during auto write operation and 1 when 
the auto write operation is completed as is the status register bit 7. 

Figure 3.1.3 shows an example of a page program flowchart. 

Each block of the flash memory can be write protected by using a lock bit. For details, refer to the section 
where the data protect function is detailed. 

Additional writes to the already programmed pages are prohibited. 
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YES 
Check full status 
Page program 
completed 


Figure 3.1.3 Page Program Flowchart 
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Block Erase Command (2016/D016) 


By writing the command code “2016” in the first bus cycle and the confirm command code “D016” in the 
second bus cycle that follows to the block address of a flash memory block, the system initiates an auto 
erase (erase and erase verify) operation. 

Whether the auto erase operation is completed can be confirmed by reading the status register or the flash 
memory control register 0. At the same time the auto erase operation starts, the read status register mode 
is automatically entered, so the content of the status register can be read out. The status register bit 7 
(SR7) is set to 0 at the same time the auto erase operation starts and is returned to 1 upon completion of 
the auto erase operation. In this case, the read status register mode remains active until the Read Array 
command (FF 16) or Read Lock Bit Status command (7116) is written or the flash memory is reset using its 
reset bit. 

The RY/BY status flag of the flash memory control register 0 is 0 during auto erase operation and 1 when 
the auto erase operation is completed as is the status register bit 7. 

After the auto erase operation is completed, the status register can be read out to know the result of the 
auto erase operation. For details, refer to the section where the status register is detailed. 

Figure 3.1.4 shows an example of a block erase flowchart. 

Each block of the flash memory can be protected against erasure by using a lock bit. For details, refer to 
the section where the data protect function is detailed. 


Write 2016 


Write D016 
to block address 


RY/BY status flag 
= 1? 


YES 


Check full status check 
Block erase 
completed 


Figure 3.1.4 Block Erase Flowchart 
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Erase All Unlock Blocks Command (A716/D016) 


By writing the command code “A716” in the first bus cycle and the confirm command code “D016” in the 
second bus cycle that follows, the system starts erasing blocks successively. 

Whether the Erase All Unlock Blocks command is terminated can be confirmed by reading the status 
register or the flash memory control register 0, in the same way as for block erase. Also, the status register 
can be read out to know the result of the auto erase operation. 

When the lock bit disable bit of the flash memory control register 0 = 1, all blocks are erased no matter how 
the lock bit is set. On the other hand, when the lock bit disable bit = 0, the function of the lock bit is effective 
and only unlocked blocks (where lock bit data = 1) are erased. 


Lock Bit Program Command (7716/D016) 


By writing the command code “7716” in the first bus cycle and the confirm command code “D016” in the 
second bus cycle that follows to the block address of a flash memory block, the system sets the lock bit for 
the specified block to 0 (locked). 

Figure 3.1.5 shows an example of a lock bit program flowchart. The status of the lock bit (lock bit data) can 
be read out by a Read Lock Bit Status command. 

Whether the lock bit program command is terminated can be confirmed by reading the status register or 
the flash memory control register 0, in the same way as for page program. 

For details about the function of the lock bit and how to reset the lock bit, refer to the section where the data 
protect function is detailed. 


Write 7716 


Write D016 
to block address 


RY/BY status flag 
-1? 


Lock bit program in 
error 


YES 


Lock bit program 
completed 


Figure 3.1.5 Lock Bit Program Flowchart 
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Read Lock Bit Status Command (7116) 


By writing the command code “7116” in the first bus cycle and then the block address of a flash memory 
block in the second bus cycle that follows, the system reads out the status of the lock bit of the specified 


block on to the data (D6). 
Figure 3.1.6 shows an example of a read lock bit program flowchart. 


Write 7116 
Enter block address 


(Note) 
D6 = 02 
YES 
Blocks locked 


Note: Data bus bit 6. 


Blocks not locked 


Figure 3.1.6 Read Lock Bit Program Flowchart 


Data Protect Function (Block Lock) 


Each block in Figure 3.1.1 has a nonvolatile lock bit to specify that the block be protected (locked) against 
erase/write. The Lock Bit Program command is used to set the lock bit to 0 (locked). The lock bit of each 


block can be read out using the Read Lock Bit Status command. 


Whether block lock is enabled or disabled is determined by the status of the lock bit and how the flash 


memory control register 0’s lock bit disable bit is set. 


(1) When the lock bit disable bit = 0, a specified block can be locked or unlocked by the lock bit status (lock 
bit data). Blocks whose lock bit data = 0 are locked, so they are disabled against erase/write. 
On the other hand, the blocks whose lock bit data = 1 are not locked, so they are enabled for erase/ 


write. 


(2) When the lock bit disable bit = 1, all blocks are unlocked regardless of the lock bit data, so they are 
enabled for erase/write. In this case, the lock bit data that is 0 (locked) is set to 1 (unlocked) after 


erasure, so that the lock bit-actuated lock is removed. 
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Status Register 


The status register indicates the operating status of the flash memory and whether an erase or program 
operation has terminated normally or in an error. The content of this register can be read out by only 
writing the read status register command (7016). Table 3.1.3 details the status register. 

The status register is cleared by writing the Clear Status Register command (5016). 

After a reset, the status register is set to “8016.” 

Each bit in this register is explained below. 


Write State Machine (WSM) Status (SR7) 
After power-on, the write state machine (WSM) status is set to 1. 
The write state machine (WSM) status indicates the operating status of the device, as for output on the 
RY/BY pin. This status bit is set to 0 during auto write or auto erase operation and is set to 1 upon 
completion of these operations. 


Erase Status (SR5) 
The erase status informs the operating status of auto erase operation to the CPU. When an erase error 
occurs, it is set to 1. 
The erase status is reset to 0 when cleared. 


Program Status (SR4) 
The program status informs the operating status of auto write operation to the CPU. When a write error 
occurs, it is set to 1. 
The program status is reset to 0 when cleared. 
When an erase command is in error (which occurs if the command entered after the block erase com- 
mand (2016) is not the confirm command (D016), both the program status and erase status (SR5) are set 
to 1. 
When the program status or erase status = 1, the following commands entered by command write are not 
accepted. 
Also, in one of the following cases, both SR4 and SR5 are set to 1 (command sequence error): 
(1) When the valid command is not entered correctly 
(2) When the data entered in the second bus cycle of lock bit program (7716/D016), block erase (2016/ 
D016), or erase all unlock blocks (A716/D016) is not the D016 or FF16. However, if FF16 is entered, 
read array is assumed and the command that has been set up in the first bus cycle is canceled. 


Block Status After Program (SR3) 
If excessive data is written (phenomenon whereby the memory cell becomes depressed which results in 
data not being read correctly), “1” is set for the program status after-program at the end of the page write 
operation. In other words, when writing ends successfully, “8016” is output; when writing fails, “9016” is 
output; and when excessive data is written, “8816” is output. 
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Table 3.1.4 Definition of Each Bit in Status Register 


Each bit of 


SRD Status name 


Write state machine (WSM) status 


Definition 


Ready Busy 


Reserved 


Erase status 


Terminated in error | Terminated normally 


Program status 


Terminated in error | Terminated normally 


Block status after program 


Terminated in error | Terminated normally 


Reserved 


Reserved 


Reserved 


Full Status Check 


By performing full status check, it is possible to know the execution results of erase and program operations. 
Figure 3.1.7 shows a full status check flowchart and the action to be taken when each error occurs. 


Read status register 


YES Command 
1 SS ecieor_) 
NO 


Program error (page]. . . 


Program error 
(block) 


End (block erase, program) 


Execute the clear status register command (5016) 
to clear the status register. Try performing the 
operation one more time after confirming that the 
command is entered correctly. 


Should a block erase error occur, the block in error 
cannot be used. 


Execute the read lock bit status command (7116) 
to see if the block is locked. After removing lock, 
execute write operation in the same way. If the 
error still occurs, the page in error cannot be 
used. 


_ After erasing the block in error, execute write 
operation one more time. If the same error still 


occurs, the block in error cannot be used. 


Note: When one of SR5 to SR3 is set to 1, none of the page program, block erase, 
erase all unlock blocks and lock bit program commands is accepted. Execute the 
clear status register command (5016) before executing these commands. 


Figure 3.1.7 Full Status Check Flowchart and Remedial Procedure for Errors 
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3.2 Developing The Boot Program 


The standard boot program that was built into the boot ROM area of the flash microcomputer when shipped 
from the factory can be used to program/erase the flash memory. In this case, the hardware resources 
(internal functions) used for control are fixed. Therefore, if you want to control flash memory in the way 
suitable for your system, you need to create a boot program for yourself. 

This section shows an algorithm for the boot program (e.g., for erase and program) that you must at least 
have in order to control the flash memory of the M16C/62 group. 


System Example 


By using the internal peripheral function of UART1 and a serial programmer to control flash memory, the 
following shows an example of device connections is shown in Figure 3.2.1. Assignments of internal 
peripheral functions are listed in Table 3.2.1. 


—- 


Clock input CLK1 
BUSY output RTS1(BUSY) 


Data input RxD1 


Data output TxD1 


e- M16C/62 flash = 
memory version 


CNVss 


(1) Control pins and external circuitry will vary according to peripheral unit (programmer). For more 
information, see the peripheral unit (programmer) manual. 
(2) In this example, the microprocessor mode and standard serial I/O mode are switched via a switch 


Figure 3.2.1 Example of Device Connection 


Table 3.2.1 Assignments of Internal Peripheral Functions 


Peripheral function Usage Setting example 


UARTI Used for transfer/receive of serial * Clock synchronous serial I/O 
programmer and data ¢ External clock is used 


Timer AO Used for time-over judgment of serial * One-shot timer mode 


transfer/receive * 300 us(when 20MHz) 


M16C/62 Group 
3.2 Developing The Boot Program 
Flow of The Main Processing 


Figure 3.2.2 shows a flow of the main processing. 
After initializing the CPU, transfer the write control program to RAM. When transfer is finished, jump to 
RAM and execute the write control program from RAM. 


RAM transfer program on ROM Write control program on RAM 


CPU programming mode aa alc atag 


Initial setting 2 
Initial setting 1 
Transfer to RAM 


Data receive 


Command processing 
Data transfer 
Time out processing 


Figure 3.2.2 Flow of The Main Processing 
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Initialization 1 (CPU, Memory) 


The CPU and RAM are initialized. Figure 3.2.3 shows a flow of initialization 1. To clear RAM, use of string 
instructions will prove effective. 


Initial setting 1 


Set ISP and SB 


Set 'H" to BUSY pin 


Port 6 (P6: address 03EC16) 
b4 


LET ST Me TIE 


ee Set 'H' data 
Port 6 direction register (PD6: address 03EE16) 
b4 


fds IIE TT 


Lgddosec@eadss Set output port 


RO <<— Set initial value 

Al <<— Set top address of RAM 

R3 [|< Programing control program size /2+0. 
After setting these registers, execute SSTR.W 


RAM clear 


Protect register (PRCR: address 000A16) 


b1 b0 


PLT TTT 


Le System clock write enabled 
“---- Processor mode register write enabled 
System clock control register 0 (CMO: address 000616) 


b7 b6 b5 b4 b3 b2 bi bO 


EAE oo 


Berees ores as CM16 and CM17 is enabled 
System clock control register 1(CM1: address 000716) 


b7 b6 b5 b4 b3 b2 b1 b0 


DggO0000 


LU ecicsate sete s ease Divided by-2 mode 
Processor mode register 0(PMO: address 000416) 


b7 b6 b5 b4 b3 b2 b1 b0 


Processor mode register 1(PM1: address 000516) 
b7 b6 b5 b4 b3 b2 bi b0 


Protect release 


Set system clock 
control register 


Set processor mode 
register 
Set protect 


Figure 3.2.3 Initialization 1 
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Transfer to RAM Area 


The version information of write program and write control program are transferred to RAM. After transferring, 
jump to write control program on RAM. To transfer, use of string instructions will prove effective. 
Figure 3.2.4 shows the algorithm. 


Transfer to RAM 
Transfer version information 


Transfer preparing 


ROH[ _| <— Set source address (high-order 4 bits) 


[| ~<t— Set source address (low-order 16 bits) 
[ ~<— Set destination address 


R3 [ <t— Programing control program size /2+a 


Execute SMOVF.W 


Jump to RAM area 


JMP 


Figure 3.2.4 Transfer to RAM Area 


Initialization 2 


Set of write to Flash memory and initialization of serial communication are executed. To switch erase/write 
mode, clear the flash entry bit (bit 1 of address 3B716), then set 1. 
Figure 3.2.5 shows a algorithm. 


Initial setting 2 


Flash control register 0( address 03B716) 
Select user ROM area eee 


phe PIE 
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Change to CPU rewrite Flash control register 0(address 03B716) 
mode b7 b6 bS5 b4 b3 b2 bi b0 
Write '0'", and then '1' in 


succession. 


Go to initial setting of 
peripheral function ns CPU rewrite mode 


Figure 3.2.5 Initialization 2 


78 


3 


M16C/62 Group 
3.2 Developing The Boot Program 


Initialization 2 (Peripheral Function) 


The peripheral functions used for programming flash memory is initialized. Figure 3.2.6 shows initialization 
of UART1 for data transmit and timer AO for time-out calculation. 


From initial setting 2 


Set UART1 


UART1 transmit/receive mode register (U1MR: address 03A816) 


b7 b6 bS b4 b3 b2 bi bd 
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| of of of of of sf] 
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b7 b6 bS b4 b3 b2 bi bd 
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Figure 3.2.6 Initialization 2 (Peripheral Function) 
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Receiving Commands 


Commands are received from the serial programmer. 

Write dummy data to the transmit buffer, enable reception (the BUSY signal = low ), and wait for data from 
the serial programmer. At the timing of start reception (the BUSY signal = high ), the timer used to check 
data reception time-out is started. When data is not received within 300 msec, a time-out error is judged 
and time-out processing flag is set. 

When command reception flag is set (cmd_flg = "1"), processing jumps to data reception cycle number 
check processing. When it is not set (cmd_flg = "0"), command reception flag is set. After that, jump 
address is set based on the received serial command and processing jumps to the corresponding process. 
When the serial command is not matched, serial initialization flag is set and processing is ended. When 
the number of receive cycle matches to the prescribed number of serial reception command, command 
reception flag is initialized (cmd_flg = "0") and processing is ended. 

Figure 2.2.7 shows a processing flow. 
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Figure 3.2.7 Data Reception 


81 


Reception cycle 
completed? 


> a 
Flag initialization 


M16C/62 Group 
3 3.2 Developing The Boot Program 


ID Check Receive Processing 


ID check data is received. Transferred ID data is saved to RAM. 
Figure 3.2.8 shows a processing flow. 


ID check receive 
processing 
Transfer/receive cycles 
r3=0 
Set ID size (a1) 
temporarily 


a 


r=al 


r3=ID size(a1)? 
r3=/al 


Write to transmit buffer 
register 


Reception 
completed? 


Read the receive buffer 
register 


Store reception data to 
RAM 


r3=r3+1 
r3=4 


Set "ID size+4" to al 


End 


Figure 3.2.8 ID Data Receive Process 


Receive Cycle Setting Processing 


Data receive cycle is set by referring to transferred serial command. 
Figure 3.2.9 shows processing flow. 


Reception cycle setting 


Set the prescribed receive 


cycle to receive cycle buffer 


Figure 3.2.9 Receive Cycle Setting Processing 
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Command Processing 


Flash control command is written into memory by referring to received serial programmer command. 
The ID check is checked as to whether it has been completed or not. (ID check completed bits: 

SR10 = 1, SR11 = 1) When the ID check has been completed, decisions are made on commands such as 
page read and page program, and processing branches to the process in the match commands. 

When the ID check has not been completed, decisions are made on 3 types of commands such as ID 
processing, and processing jumps to the process in the match commands. With mismatch commands, 
processing returns to main part. 

Figure 3.2.10 shows processing flow. 
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Figure 3.2.10 Command Process 
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To read data from the user area in blocks of 256 bytes, read address is stored to RAM and Read Array 
command (FF 16) is written. The address of the read area is changed from xxx0016 to xxxFF16, and the 
data following xxx0016 is transferred in succession. 

Figure 3.2.11 shows processing flowchart. 


Page read 


Receive cycles r3=0 


Set low-order address, 
addr_l=0 


i 


r3=r3+1 


Set reception address 


Read data buffer 
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iL 


r3=2 


Write read array 
command 


Set transfer flag 


End 


Figure 3.2.11 Page Read 
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Page Program 


Data is written into the user area in blocks of 256 bytes. 

Read 258 bytes data from RAM: 2 bytes of address and 256 bytes of write data received from serial 
programer. Status data is read from the flash memory. The read status is checked. When it is under error 
state, processing does not write but returns to the main part. 

When it is not under error state, the page program command (4116) is written in the flash memory, then 256 
bytes of data is written. After data has been written, the read array command (FF 16) is written and processing 
returns to the main part. 

Figure 3.2.12 shows processing flow. 


Page program 


Receive cycles 
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Set low-order address, 
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Figure 3.2.12 Page Program 
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Block Erase 


A specified block area of the flash memory is erased. However, blocks that are locked by Lock Bit Program 
command cannot be erased. To erase these blocks, you need to disable the lock bit. 

After confirming the two bytes of address and one byte of confirm command (D016) received from the serial 
programmer and stored in RAM, write Block Erase command (2016) and confirm command (D016) to the 
area specified by the received address for block erase processing. 

If the received confirm command is incorrect, block erase processing cannot be performed. In this case, 
write Read Array command (FF 16) to the flash memory to return the processing to the main routine. 
Figure 3.2.13 shows a processing flow. 


Block erase 
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r3=1 


Set low-order address, 
addr_l=OFEh 
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OK 
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- 
Write read array 
command 


Initialize transfer flag 


End 


Figure 3.2.13 Block Erase 
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Erase All Unlock Block 


A specified block area of the flash memory is erased. However, blocks that are locked by Lock Bit Program 
command cannot be erased. To erase these blocks, you need to disable the lock bit. 

When the all erase command is received from a serial programmer, receive more 1 byte data in succession. 
After the second data is checked to see if it is confirm command (D016), write Erase All Unlock command 
(2016) and confirm command (D016) to the area specified by the received address for erase all unlock 
block processing. 

If the received confirm command is incorrect, erase all unlock block processing cannot be performed. In 
this case, write Read Array command (FF 16) to the flash memory to end the processing. 

Figure 3.2.14 shows a processing flow. 


Erase all unlock blocks 
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Read the receive 
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Confirm the 
confirm command 


OK 
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command 
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End 


Figure 3.2.14 Erase All Unlock Block 
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Read Status Register 


Two bytes of status data indicating the flash memory's operating status is stored to RAM to transmit via 
serial I/O. 

Write the Read Array command (FF 16) to the flash memory, then write the Read Status command (7016). 
After status register reception, write the Read Array command and return to the main routine. 

Figure 3.2.15 shows a processing flow. 


Read status register 


Transfer/receive cycles 
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Write read array 
command 
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register command 
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End 


Figure 3.2.15 Read Status Register 
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Clear Status Register 


Status register error information is cleared. 

The Read Array command (FF16), Clear Status command (5016) and Read Array command (FF 16) are 
written into the flash memory in succession. 

The logic sum for the status register 1 (SRD1) is obtained on #9C16 and the error flag is cleared. Processing 
returns to the main part. 

Figure 3.2.16 shows a processing flow. 


Clear status register 
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Write read array 
command 


Write clear status 
register command 


Write read array 
command 


Clear SRD1 error flag 


Initialize transfer flag 


End 


Figure 3.2.16 Clear Status Register 
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Read Lock Bit Status 


One byte of data indicating the lock status of each individual block in the flash memory is saved via serial 
I/O. Of the 1-byte data, the 6th bit indicates lock status. When "1", the block is unlocked. When "0", the 
block is locked. 

After receiving two byte of data indicating address, store specified address in the address buffer. At this 
time, set #FE16 to the low order address. 

The Read Array command (FF16) and the Read Lock Bit command (7116) are written and, there after, the 
lock bit information is read from the flash memory. After the lock bit information has been read, the read 
array command (FF 16) is written again. Processing then returns to main part. 

Figure 3.2.17 shows a processing flow. 
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Figure 3.2.17 Read Lock Bit Status 
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Lock Bit Program 


Blocks in the flash memory is locked. Locked block areas cannot be erased. 

After receiving two byte of data indicating address, store specified address in the address buffer. At this 
time, set #FE16 to the low order address. 

If the received confirm command is incorrect, lock bit program processing cannot be performed. If correct, 
for lock bit program processing, write the Lock Bit Program command (7716) to the flash memory and the 
Confirm command (D016) in succession. Write Read Array command (FF 16) and processing returns to the 
main part. 

Figure 3.2.18 shows a processing flow. 


Lock bit program 


Transfer/receive cycles 
r3=1 


Set low-order address, 
addr_l=OFEh 
<a 


Set read address 


Read the receive buffer 
register 


Store reception data to 
address buffer 


r3=4 
Confirm confirm NG 
command 
OK 


Write the lock bit 
program command 


Write the confirm 
command 


Write the read array 
command 


=a 
Initialize transfer flag 


End 


Figure 3.2.18 Lock Bit Program 
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Lock Bit Enable/Disable 


Enables/disables the lock bit function of flash memory. The lock bit disable command cancels the lock on 
all blocks. 

To enable the lock bit, "0" is written for the lock bit cancel bit. To disable the lock bit, "0" followed by "1" is 
written for the lock bit cancel bit. 

Figure 3.2.19 shows a processing flow. 


Lock bit valid Lock bit invalid 
Clear the lock bit Clear the lock bit 
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Initialize transfer flag Set the lock bit 


cancel bit to "1" 
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End 


Figure 3.2.19 Lock Bit Enable/Disable 
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ID Check 


The ID data stored in the flash memory is compared with the data received by serial I/O. This process 
judges whether the flash memory is blank or not. When blank, the ID check is ended and processing 
returns to the main part. When something is written in the ROM, the received ID address, the ID data size 
and ID data contents are checked. When mismatch, ID check error is generated (SR10 = 1, SR11 =0) and 
processing returns to the main part. When match, the ID check is ended (SR10 = 1, SR11 = 1) and 
processing returns to the main part. 

Figure 3.2.20 shows a processing flow. 


ID check 
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Figure 3.2.20 ID Check 
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Version Information Output 


Transfer flag is set to transfer the version information of the boot program via serial I/O. 
Figure 3.2.21 shows a processing flow. 


Version information 
output 


Set transfer flag 


Figure 3.2.21 Version Information Output 


Data Transfer Processing 


The result of process after receiving a control command from serial programer is transfered via serial I/O. 
When transfer flag is 0, or time-out flag is 1, the processing returns to the main part. Otherwise next 
process is executed. Command buffer is read, the serial command is compared, and processing branches 
to the process in the match commands. After processing, initialize the transfer flag and return to main part. 
With mismatch commana, initialize the transfer flag and return to main part. 

Figure 3.2.22 shows a processing flow. 
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Figure 3.2.22 Data Transfer 
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Page Read Transfer Processing 


Data from the user area in blocks of 256 bytes is read and the read data is sent via serial I/O. 

Data is read from the flash memory and set to transfer buffer register. The timer used to check data 
reception time-out is started. When data is not received within 300 msec, a time-out error is judged, time- 
out processing flag is set and processing jumps to data transfer processing. After 256 bytes of data is sent, 
processing jumps to data transfer processing. 

Figure 3.2.23 shows a processing flow. 
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Figure 3.2.23 Page Read Transfer Processing 
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Read Status Register Transfer Processing 


The two-byte status data (SRD: status register and SRD1: status register 1) that indicates flash memory 
operating status is sent via serial I/O. 

The SRD is read from flash memory and written into transmit buffer register. The timer used to check data 
reception time-out is started. When data is not received within 300 msec, a time-out error is judged, time- 
out processing flag is set and processing jumps to data transfer processing. After data reception is 
completed, receive buffer register is read. 

The SRD1 is read from flash memory and written into transmit buffer register. The timer used to check 
data reception time-out is started. When data is not received within 300 msec, a time-out error is judged, 
time-out processing flag is set and processing jumps to data transfer processing. After data reception is 
completed, reception buffer register is read and processing returns to data transfer processing. 

Figure 3.2.24 shows a processing flow. 
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Figure 3.2.24 Read Status Register Transfer Processing 


96 


M16C/62 Group 
3 3.2 Developing The Boot Program 


Read Lock Bit Status Transfer Processing 


The lock bit status that set in command processing is sent via serial I/O. 

The lock bit status data that set in command processing is read from RAM and written into transmit buffer 
register. The timer used to check data reception time-out is started. When data is not received within 300 
msec, a time-out error is judged, time-out processing flag is set and processing jumps to data transfer 
processing. After data reception is completed, processing jumps to data transfer processing. 


Figure 3.2.25 shows a processing flow. 
Read lock bit status 
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Figure 3.2.25 Read Lock Bit Data Transfer Processing 
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Version Information Output Processing 


The version information of boot program is sent via serial I/O. 

Version information is read and written in the transmit buffer register. 

The timer used to check data reception time-out is started. When data is not received within 300 msec, a 
time-out error is judged, time-out processing flag is set and processing jumps to data transfer processing. 
After all version information is send, processing jumps to data transfer processing. 

Figure 3.2.26 shows a processing flow. 
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Figure 3.2.26 Version Information Output Processing 
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Time-Out Processing 


When time-out flag is set, serial I/O and time-out flag are initialized. 
Figure 3.2.27 shows a processing flow. 
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Figure 3.2.27 Time-Out Processing 


Command Write 


Commands are written in the flash memory. Commands are accepted when the flash memory is in the 
ready state (RY/BY signal status flag [bit 0 in address 03B716 of the flash memory 

control register] is "1"). 

Figure 3.2.28 shows a processing flow. 


Figure 3.2.28 Command Write 
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Status Register (SRD) 


The status register indicates operating status of the flash memory and status such as whether an erase 
operation or a program ended successfully or in error. It can be read by writing the Read Status Register 
command (7016). Also, the status register is cleared by writing the Clear Status Register command (5016). 
Table 3.2.2 shows the definition of each status register bit. After clearing the reset, the status register 
outputs "8016". 


Table 3.2.2 Status Register (SRD) 


Each bit of Definition 
Status name 


Write state machine (WSM) status Ready Busy 


Reserved : : 


Erase status Terminated in error | Terminated normally 


Program status Terminated in error | Terminated normally 


Block status after program Terminated in error | Terminated normally 


Reserved 


Reserved 


Reserved 


Write State Machine (WSM) Status (SR7) 
The write state machine (WSM) status indicates the operating status of the flash memory. When power is 
turned on, "1" (ready) is set for it. The bit is set to "O" (busy) during an auto write or auto erase operation, 
but it is set back to "1" when the operation ends. 


Erase Status (SR5) 
The erase status reports the operating status of the auto erase operation. If an erase error occurs, it is set 
to "1". When the erase status is cleared, it is set to "0". 


Program Status (SR4) 
The program status reports the operating status of the auto write operation. If a write error occurs, it is set 
to "1". When the program status is cleared, it is set to "0". 


Block Status After Program (SR3) 

If excessive data is written (phenomenon whereby the memory cell becomes depressed which results in 
data not being read correctly), "1" is set for the block status after-program at the end of the page write 
operation. In other words, when writing ends successfully, "8016" is output; when writing fails, "9016" is 
output; and when excessive data is written, "8816" is output. 

If "1" is written for any of the SR5, SR4 or SR3 bits, the Page Program, Block Erase, Erase All Unlocked 
Blocks and Lock Bit Program commands are not accepted. Before executing these commands, execute 
the Clear Status Register command (5016) and clear the status register. 
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Status Register 1 (SRD1) 


Status register 1 indicates the status of serial communications, results from ID checks and results from 
check sum comparisons. It can be read after the SRD by writing the Read Status Register command 
(7016). Also, status register 1 is cleared by writing the Clear Status Register command (5016). 

Table 3.2.3 gives the definition of each status register 1 bit. "0016" is output when power is turned ON and 
the flag status is maintained even after the reset. 


Table 3.2.3 Status Register 1 (SRD1) 


Each bit of Definition 
SRD1 Status name 


Boot update completed bit Update completed Not update 


SR15 (bit7) 

SR14 (bit6) 

SR13 (bit5) 

SR12 (bit4) | Checksum match bit Match Mismatch 
(bit3) 
(bit2) 


Reserved 


Reserved 


SR11 (bit3 
SR10 (bit2 


ID check completed bits 00 Not verified 

01 Verification mismatch 
10 Reserved 

11 Verified 


SR9Q (bit!) | Data receive time out Time out Normal operation 
SR8 (bit0) | Reserved 


Boot Update Completed Bit (SR15) 
This flag indicates whether the control program was downloaded to the RAM or not, using the download 


function. 


Checksum Match Bit (SR12) 
This flag indicates whether the check sum matches or not when a program, is downloaded for execution 


using the download function. 


ID Check Completed Bits (SR11 and SR10) 
These flags indicate the result of ID checks. Some commands cannot be accepted without an ID check. 


Data Reception Time Out (SR9) 
This flag indicates when a time out error is generated during data reception. If this flag is attached during 
data reception, the received data is discarded and the microcomputer returns to the command wait state. 
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3.3 Sample List 


This section shows a sample list of the program described in Section 3.2. 

In addition to the processing explained in Section 3.2, the sample shown below includes the programmer 
command processing used by a synchronous serial programmer and the command processing used by an 
asynchronous serial communication programmer (M16C Flash Start). 


Source 


KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KEK KKK KKK KKK KKK KKK KKK KKK 


I 
Pal System Name : Sample Program for M16C/62 Flash * 
pe File Name : M624SAMP.a30 x 
Ha MCU : M30624FG(L) FP/GP - 
7% : M30625FG(L) GP im 
;* Xin : 2MHz — 16MHz (for UART mode) bas 
;* Assembler : AS30 ver 3.00 * 
7* Linker : LN30 ver 3.00 bas 
7* * 
;* Copyright,1999 MITSUBISHI ELECTRIC CORPORATION * 
se AND MITSUBISHI SEMICONDUCTOR SYSTEM CORPORATION * 

* * 


, 


ZTFEFFFTTTEFEFETTLEFEFETELFFFETTEEFFFETTEFEFETETEEFF EE P+ +44 


pt Include file + 
Fr issn LR LO 
~LESt off 
. include sfr62.inc 
.include flash624.inc 
-list on 


, 


ZFTLFFFTTTEFEFFTHLEFEFETTLFFFFTTEEFFFETTEFFFF ESTEE E TH H+ 


7+ Version table + 
ZEEE EFHEEEFHEEEFHEEEFEEEFEEEFEEEFHEEEFEEEFEEEFEEEFEEEFEEEE 
.-section rom, code 
-org Version 
-byte "VER.0.00(VER.2.02)' 


a 


ZTFEFFFTTLEFEFETLLFFEFE TT LFFFET TELE TTTEFEFETETEFFP ETP + +++ 


7+ Program section start E 
PEEEEAEEEEEEEEE EE FAEEEEEEEE EEE EEE EELEEEEEE EAE EEE EEE EEE EEE F 
-section prog, code 
.org Boot_TOP 
.sb SB_base 
.sbsym SRD 
.sbsym SRD1 
.sbsym ver 
.sbsym SF 
.sbsym addr_1l 
.sbsym addr_m 
.sbsym addr_h 
, 
y+ Boot program start + 
, 
Reset: 
, 
e+ Initialize_1l + 
, 
lde #Istack, ISP ; stack pointer set 
ldc #SB_base, SB ; SB register set 
bset busy 
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bset busy_d 7 BUSY "H"output 
belr s_mode_d ; Serial mode select input 
; 
r 
pt Hot start & RAM clear + 
r 
protects RAM Check -----— 
RAM_Check: 
mov.b 0,ril 
cmp .b SRD1,SRD1_bak ; checkl 
jeq RAM Check2 
cmp .b SRD1_bak, SRD1_bak+2 ; check2 
jeq RAM _Check3 
cmp .b SRD1,SRD1_bak+2 ; check3 
jne CRC_Check 
r 
RAM_Check2: 
mov.b SRD1,r1l ee <= SRD L 
jmp CRC_Check 


’ 


RAM_Check3: 


; rll <- SRD1_bak 


; Ram data CRC 


; Old CRC code 


7 CRC input data 


; Jump RAM clear 


; RAM Check OK flag set 


mov.b SRD1_bak, r11 
jmp CRC_Check 
; 
r 
ook CRC Check + 
r 
777777- CRC Check ----- 
CRC_Check: 
jsr SUB_CRC 
r 
mov.b Ram_progTOP[a0],r0l 
mov.b ROL,crcin 
mov.b Ram_progTOP+1[a0],r0l 
mov.b rOl,crcin 
mov.w ered, £0 
cmp .w 0,xr0 
jne RAM clear 
; 
r 
;+ UPDATE Check + 
; 
r 
bset ram_check 
jmp CPU_set 
r 
RAM_clear: 
mov.W #0,xr0 
mov.Ww # (Ram_END+1-Ram_TOP) /2,r3 
mov.W #Ram_TOP,al 
Sstr.w 
and.b #0ch, r1l 


7+ Processor mode register + 

ot & System clock control register + 

r 

CPU_set: 
mov.b #3,prcer ; Protect off 
mov.w #8000h, pm0 ; 1 wait 
mov.w #6008h, cm0 fo EZ 
mov.b #0,prer ; Protect on 
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Reload_chack: 


btst srl5 ; Update ? 
ake Transfer_end 
btst ram_check ; Reload ? 
jz Version_inf ; Yes 
, 
, 
7+  SI/O Mode Check + 
, 
r 
btst s_mode ; SI/O Mode old = new ? 
bxor old_mode 
jne Transfer_end , Yes, jump Transfer_end 
, 
, 
3+ Version information + 


, 


Version_inf: 


belr dwn_flg 
mov.w #0,a0 ; ad=0 
Ver_loop: 
lde.w Version+9[a0],ver[a0] ; Version data store 
add.w #2,a0 ; address increment 
cmp .w #8,a0 ; a0d=8 ? 
jltu Ver_loop 7 jump Ver_loop at a0<8 
v 
, 
p+ Program_transfer + 
r 
btst s_mode ; Serial I/O mode select 
jz Transfmcr2 ; UART mode 
, 
Transfmcrl: 
bset old_mode ; clock synchronous mode 
mov.w #(Trans_TOP1 & Offffh),a0 ; Transfer source address (Low) 
mov.b #(Trans_TOP1 >> 16),rlh ; Transfer source address (high) 
mov.W #Ram_progTOP,al ; Transfer destination address 
mov.w #(Trans_END1 - Trans_TOP1)/2,r3 ; Transfer number 
smovf.w ; String move 
jmp Transfer_end0 
r 
Transfmcr2: 
belr old_mode ; UART mode 
mov.w #(Trans_TOP2 & Offffh),a0 ; Transfer source address (Low) 
mov.b #(Trans_TOP2 >> 16),rl1h ; Transfer source address (high) 
mov.Ww #Ram_progTOP,al ; Transfer destination address 
mov.w #(Trans_END2 - Trans_TOP2)/2,r3 ; Transfer number 
smovf.w ; String move 


v 

Transfer_end0: 
jsr SUB_CRC ; Transfer data CRC 
mov.w ered, r0 » CRC code =—> 270 
mov.w r0,Ram_progTOP [a0] 

r 

Transfer_end: 


, 


HK Jump to RAM + 


v 
jmp Ram_progTOP 
, 
PEEEEEFEEEEEELEFEEEEEEELEFEEEEEEEEEAEEEEE PEF A FEE EEF TH 
p+ Subroutine : SUB_CRC + 
PEEEEEEEEEEEELEEEEEEEEEEEFEEEEEEEEFEE EEE EEA A EEE EPTH 
SUB_CRC: 
mov.w #OFFFFh, cred ; CRC data register set 
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Ram data --> ro 
CRC input regis 


receive number 
sumcheck buffer 
Download flag r 
Check sum flag 


time out error 


jump Download_err at time out 


receive data re 
r3 +1 increment 


1 
ter 


(r3=0) 


eset 
reset 


? 


ad --> r0 


jump Version_store at r3>3 


r3 --> a0 
Store program s 
aQ initialize 


ize 


No, jump Download_loop 


program size = 


0 ? 


M16C/62 Group 


3.3 Sample List 


jump to Version_inf at program size error 
jump Download_loop 


jump Program_store at r3 >11 
version data store to RAM 


mov.w #0, a0 
ae 
mov.b Ram_progTOP[a0],r0Ol ; 
mov.b r0Ol,crcin - 
inc.w a0 
cmp.w #Ram_progEND-Ram_progTOP-2, a0 
jne ?- 
res 
, 
r 
pt Download program + 
r 
.Oorg Download_program 
r 
jsr set_TAO 
r 
mov.w #0,4r3 : 
mov.w #0,al ; 
belr srl15 ; 
beclr sxr12 7 
Download_loop: 
jsr SIO_D_rcv 
btst tout_flg ; 
jc Download_err - 
mov.w reviod,ro : 
add.w #1,xr3 ‘ 
cmp .w #3,4r3 ; r3=3 ? 
jgtu Version_store : 
mov.w r3,a0 : 
mov.b r01l,addr_1[a0] : 
mov.w #0,a0 ; 
cmp .w #3,4r3 ; v3 = 3? 
jne Download_loop ; 
cmp .w #0,addr_m . 
jz Version_inf 7 
jmp Download_loop ; 
Version_store: 
cmp .w #11,r3 ; r3=11 ? 
jgtu Program_store ; 
mov.b r0Ol,ver[a0] : 
jmp Program_store_1 


’ 


Program_store: 
r01,Ram_progTOP-8 [a0] 
Program_store_1: 


mov.b 


add.b 
add.w 
cmp .w 
jltu 
jmp 


’ 


rOl,al 

#1,a0 
addr_m, a0 
Download_loop 
Download_CRC 


Download_err: 


7 program data store to RAM 


add data to al 


a0 (downloaO offset) 


aO = program si 


ze (addr_m,h) ? 


+1 increment 


jump Download_loop at a0< program size 
jump Download_CRC 


bset busy 7 busy "“"H" 
bset busy_d 7 busy output 
mov.b #0,ulcl ; transmit/receive disable 
mov.b #0,ulmr ; ulmr reset 
jmp Version_inf 
, 
r 
jt Download program -— UART mode - + 
r 
.Oorg U_Download_program 
r 
mov.w #0,4r3 ; receive number (r3=0) 
mov.w #0,al ; sumcheck buffer 
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belr 
belr 


sr15 
sr12 


U_Download_loop: 


jsr U_SIO_D_rcv 

mov.w rov.d, x0 

add.w #1,xr3 

cmp.w #3,4r3 

jgtu U_Version_store 

mov.w r3,a0 

mov.b r01,addr_1[a0] 

mov.w #0, a0 

cmp.w #3,4r3 

jne U_Download_loop 

cmp .w #0,addr_m 

jz Version_inf 

jmp U_Download_loop 
U_Version_store: 

cmp.w #11,xr3 

jgtu U_Program_store 

mov.b r0l1,ver[a0] 

jmp U_Program_store_1 


, 


U_Program_store: 


, 


mov.b r01,Ram_progTOP-8 [a0] 
U_Program_store_1: 

add.b r0Ol,al 

add.w #1,a0 

cmp .w addr_m, a0 

jltu U_Download_loop 


Download_CRC: 


mov.w al,r0O 
cmp.b data,r0l 
bmeq sxr12 
jne Version_inf 
bset sr15 
, 
jsr SUB_CRC 
mov.w crcd, r0 
mov.Ww r0,Ram_progTOP [a0] 
jmp Ram_progTOP 


a 
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Download flag reset 
Check sum flag reset 


r3 +1 increment 

r3=3 ? 

jump U_Version_store at r3>3 

r3 --> a0 

Store program size 

aO initialize 

r3 = 3? 

No, jump U_Download_loop 

program size = 0? 

jump to Version_inf at program size error 


r3=11 ? 
jump U_Program_store at r3 >11 
version data store to RAM 


7 program data store to RAM 


add data to al 

a0 (downloaO offset) +1 increment 

a0 = program size (addr_m,h)? 

jump Download_loop at a0< program size 


compare check sum 

check sum flag set at data=r0l 

jump Version_inf at check sum error 
Download flag set 


Download data CRC 


jump Ram_progTOP 


pTFLFFFTT LEFF TTL EFEFETLLFFFEFETEFFFTTTEFEFETETEEFF EET + +44 


a synchronized signal I/O receive dwnt 


pEFEFFFTTLLFEFETTLEFEFETTLFEFETTEEFFFTTTEFEFETEPEFFF EET + +++ 


a+ Subroutine 
SIO_D_rcv: 
mov.b rll,ultb 
bset ta0os 
2,8 
btst ir_taOic 
bmc srg 
1¢ SIO_D_rcv_err 
btst ri_ulcl 
jne ?- 
mov.w ulrb, rcv_d 


STIO_D_rcv_end: 


res 


SIO_D_rcv_err: 


bset 13, 
jmp Ss 


, 


out_flg 
IO_D_rcv_end 


ta0O start 


time out error ? 
time out flag set 
jump SIO_D_rcv_err 
receive complete ? 


receive data read --> r0 


ZFHEFFFTHT LEFF TTLFFEFETTLFFFFTTEFEFFTTTEFEFETE TEEPE EPP 44+ 


yt Subro 


utine 


UART receive dwn + 
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FEEFFFTTTLFFFE FT LEFEFETTLEFFFETLEFFFFTELLEFF ET EEEF TPE E + +444 


U_S10-D rev: 
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btst ri_ulcl 7 receive complete ? 

jne U_SIO_D_rcv 

mov.w ulrb; rev id ; receive data read --> r0 

rts 
; 
;+ Transfer Program -- clock synchronous serial I/O mode + 
aah (1) Main flow + 
jt (2) Flash control program + 
z+ Read, Program, Erase,All_erase,etc. + 
7+ (3) Other program + 
t+ ID_check, Download, Version_output etc. + 
i 

-section dump, code 

.org Trans_TOP1 
PELEEFEFAFEEEEEEEFEEEEEEEEEEEEEEEEEEEEEEEEEEE LEAF EEE HEPAT 
et Main flow - clock synchronous serial I/O mode - + 
Fs is Ss Se 
Main: 

jsr Initialize _2 ; clock synchronous serial I/O mode 


mov.b #0,data 


Loop_main: 


mov.b SRD1,SRD1_bak 
mov.b SRD1,SRD1_bak+2 


7 SRD1 back up 


jsr time_init 
jsr SIO_rcv_first_data 
jsr Flash_func 
jsr SIO_send_data 
jsr Time_out 
jmp Loop_main 
, 
; 
pt initialize SIO + 


’ 


time_init: 


belr tout_flg 
beir tint_flg 
bset ta0os 


mov.b #0,ta0ic 


Loop_mainl: 


; 300 usec ? 


; SRD1 time out flag set 


; command error,UART1 reset 


btst ir_taOic 
jz Loop_mainl 
bset rcev_flg 
rus 
, 
; 
7+ SI/O time out + 
; 
Time_out: 
btst tint_flg 
qc Time_out_init 
btst tout_flg 
jne Time_out_end 
bset srg 
belr tout_flg 
Time_out_init: 
belr tint_flg 
jsr Initialize 21 
Time_out_end: 
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rt 
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SI/O recieve data + 


, 


STIO_rcv_first_data: 


mov.b #0,cmd_d 
belr cmd_flg 
btst rev_flg 

jne STO_rcv_end 
btst tout_flg 

jc SIO_rcv_end 
mov.b #0,ta0ic 
mov.w #0,1r2 


SIO_rcv_first_data_loop: 
mov.b #0ffh,r11 ; #f£fh --> rll (transfer data) 
mov.b 211, Gleb 
btst cmd_flg 
jc SIO_rcv_first_data_loopl 
bcelr busy_d ; busy input 
?: btst busy ; Reception start? 
jz oa 
SIO_rcv_first_data_loopl1: 
bset tados ; 300 usec timer start 
, 
SIO_rcv_first_data_loop2: 
btst ir_ta0Oic ; 300 usec ? 
jne P+ 
bset tout_flg ; time out 
22 “best tout_flg 
1c SIO_rcv_end 
btst ri_ulcl 7 receive complete ? 
jz SIO_rcv_first_data_loop2 
mov.w ulrb, r0 ; veceive data > £0 
mov.w r2,a0 
mov.b r01,data[a0] 
add.w #1,r2 
, 
btst cmd_flg 
7¢ SIO_loop_chk 
bset cmd_flg 
mov.b r01,cmd_d 
, 
mov.w #15,a0 
SIO_rcv_command_chk: 
lde.b Index_tbl1-Trans_TOP1+Ram_progTOP-1[a0],r0h 
cmp.b rOh, r01l 
jeq SIO_cmd_jmp_2 
sbjnz.w #1,a0,STO_rcv_command_chk 
jmp SIO_rcv_end_1 


a 


SIO_cmd_jmp_2: 


shl.w #1,a0 

lde.w jmp_tb1_2-Trans_TOP1+Ram_progTOP-2[a0],r0 
SIO_cmd_jmp_2_1: 

jmpi.w r0 
, 
SIO_2: 

mov.w 2, loop_cnt 

jmp SIO_loop_chk 
SIO_259: 

mov.w 259, loop_cnt 

jmp SIO_loop_chk 
SIO_4: 

mov.w 4,loop_cnt 

jmp SIO_loop_chk 
SIO_3: 
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mov.w #3, loop_cnt 
jmp SIO_loop_chk 
, 
r 
p+ ID check SI/O + 
r 
SIO_rcv_ID_check: 
mov.w #0,4r3 ; receive number (r3=0) 
mov.w #0ffh,al ; ID size (dummy data = ffh) 
mov.b #0,ta0ic 
SIO_ID_data_store: 
cmp.w al,xr3 ; v3=al(ID size) 
jeq SIO_ID_address_check; jump ID_address_check at r3=ID size 
mov.b r1l,ultb ; data transfer 
bset tados ; tad start 
SIO_ID_data_loop: 
btst ir_taQ0ic ; 300 usec ? 
jne ?+ 
bset tout_flg ; time out 
?: btst tout_flg 
jc SIO_ID_address_check 
btst ri_ulcl ; receive complete ? 
jne SIO_ID_data_loop 
mov.w ulrb, r0 ; receive data read --> r0 
mov.w r3,a0 e 3 se)? all 
mov.b r01l,addr_1[a0] ; Store address 
add.w #1,xr3 ; v3 +1 increment 
cmp .w #4,4r3 ; r3=4 ? 
jne SIO_ID_data_store 7 jump ID_data_store at r3 not= 4 
mov.b data,al ; ID size --> al 
add.w #4,al ; al=al+4 
jmp SIO_ID_data_store 7 jump ID_data_store 


SIO_ID_address_check: 


jmp 


’ 


STO_rcv_end 


SIO_rcv_end_1: 


bset 
jmp 


tint_flg 
SIO_rcv_end 


SIO_loop_chk: 


cmp .w loop_cnt, r2 
jltu SIO_rcv_first_data_loop 
STO_rcv_end: 
belr cmd_flg 
belr rcev_flg 
rts 
; 
; 
7+ SIO_send data + 
; 
STO_send_data: 
jsr set_TAO 
btst send_flg 
jne STO_send_data_end 
btst tout_flg 
jc STO_send_data_end 
mov.b cmd_d,rlh 
; 
cmp.b #O0ffh,r1lh ; Read(ffh) 
jeq Read_data 
cmp.b #070h,rih ; Read SRD (70h) 
jeq Read_SRD_data 
cmp.b #071h,r1lh ; Read LB (71h) 
jeq Read_LB_data 
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cmp.b #0fbh,rlh 4 
jeq Ver_output_data 
cmp.b #0fdh,rlh ; 
jeq Read_check_data 
cmp.b #0fch,rlh ; 
jeq Boot_data 

jmp STO_send_func 


, 


Read_check_data: 


mov.w #0,4r3 

mov.w sum, rl 
Read_check_data_loop: 

mov.b PLI,ULeb 

bset tados : 
Read_check_data_check: 

btst ir_taOic 

jne P+ 

bset tout_flg 
28 

btst tout_flg 

jc SIO_send_data_end 

btst ri_ulcl : 

jne Read_check_data_check 

mov.w ulrb, r0 ; 

mov.b rlh,ril 

add.w 1,r3 

cmp .w 2,x3 

jltu Read_check_data_loop 
Read_check_data_end: 

mov.w 0, sum : 

jmp SIO_send_data_end 
r 
Read_data: 

mov.w #0,4r3 
Read_data_loop: 

lde.b fala0O],r1l ; 

mov.b rll,ultb 

bset tados : 
Read_data_chk: 

btst ir_taOic ‘ 

jne P+ 

bset tout_flg : 
ee 

btst tout_flg 

je Read_data_end 

btst ri_ulcl A 

jne Read_data_chk 

mov.w ulrb, r0 ; 

add.w LF e3 

add.w 1,a0 

cmp .w 256,x3 : 

jne Read_data_loop 
Read_data_end: 

jmp SIO_send_data_end 


i 

Ver_output_data: 

#0, a0 

Ver_output_data_loop: 
mov.b ver[a0],ultb 
bset ta0os 

Ver_output_data_check: 


mov .w 


, 


btst ir_taOic ; 
jne P+ 
bset tout_flg 7 
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Version_output (fbh) 


Read_check (fdh) 


Boot_check (fch) 


ta0O start 


receiv ? 


complet 


receive data read --> r0 


reset 


Flash memory read 


ta0O start 


300 usec ? 


time out 


receiv id 


complet 


receive data read --> r0 


Version address offset (a0=0) 


;send_data set 


ta0O start 


300 usec ? 


time out 
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btst tout_flg 

jc Ver_output_data_end 
btst ri_ulcl : 
jne Ver_output_data_check 
mov.w ulrb,;r0 ; 
add.w #1,a0 

cmp .w #8,a0 : 
jne Ver_output_data_loop 


Ver_output_data_end: 
jmp STO_send_data_end 
; 


Read_SRD_data: 


mov.Ww #0,4r3 
Read_SRD_data_loop: 

belr tout_flg : 

mov.b #0,ta0ic 7 

mov.b r1l,ultb : 

bset tados : 
Read_SRD_data_check: 

btst ir_taQ0ic ; 

jne ?t+ 

bset tout_flg : 
?: btst tout_flg 

jc Read_SRD_data_end 

btst ri_ulcl : 

jnec Read_SRD_data_check 

mov.w ulrb; 70 - 

mov.b SRD1,r11 : 

add.w 1,xr3 

cmp .w 2,3 ; 

jltu Read_SRD_data_loop ; 


Read_SRD_data_end: 

jmp STO_send_data_end 
; 
Read_LB data: 
Read_LB_ data_loop: 


mov.b r1l,ultb : 

bset tados rs 
Read_LB_ data_check: 

btst ir_taOic : 

jne P+ 

bset tout_flg : 
28 

btst tout_flg 

jc Read_LB_data_end 

btst ri_ulcl - 

jnec Read_LB_data_check 

mov.w ulrb, rd ; 


Read_LB_data_end: 


jmp STO_send_data_end 
r 
Boot_data: 
belr fmer5 
mov.w addr_1,a0 
mov.b addr_h,al 
mov.Ww #0,4r3 
Boot_data_loop: 
lde.b [ala0],r1l A 
mov.b rll,ultb 
bset tados : 
Boot_data_chk: 
btst ir_taO0ic : 
jne P+ 
bset tout_flg : 
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receive complete ? 


receive data read --> r0 


clear time out 
clear time out 
data transfer 
tad start ; test 


300 usec ? 


time out 


receive complete ? 


receive data read --> r0 
SRD1 data --> rll 


r3 =2 ? 
jump Read_SRD_loop at r3<2 


data transfer 
ta0O start 


300 usec ? 


time out 


receive complete ? 


receive data read --> r0 


Flash memory read 
ta0O start 
300 usec ? 


time out 
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btst tout_flg 
jc Boot_data_end 
btst et he 7 receive complete ? 
jne Boot_data_chk 
mov.w ulrb, r0 ; veceive data read --> r0 
add.w #1,xr3 
add.w #1,a0 
cmp .w #256,4r3 3; v3 = 256 ? 
jne Boot_data_loop 
Boot_data_end: 
bset fmcer5 
jmp SIO_send_data_end 


, 


SIO_send_func: 


mov.W start_cnt,r3 
SIO_send_data_loop: 
mov.w r3,a0 
mov.b data[a0],r1l 
mov.b rll,ultb ; data transfer 
bset tados ; tad start 
SIO_send_chk: 
btst ir_taOic ; 300 usec ? 
jne P+ 
bset tout_flg ; time out 
?: btst tout_flg 
jc SIO_send_data_end 
btst ri sole. 7 xveceive complete ? 
jne SIO_send_chk 
mov.w ulrb, r0 ; veceive data read --> r0 
add.w #1,xr3 
cmp .w send_cnt,r3 ; v3 = send_cnt ? 
jne STO_send_data_loop 
mov.w raorgd 
SIO_send_data_end: 
belr send_flg 
ces 


Vv 
Fr iss a a OL 
et Subroutine : Time_over_flg + 
Fr iss a a OL 
Time_over_flg: 

bset tout_flg 

rts 


PHEEAFAFEFFAFEEFAFEEEFEEFEEFEFEEEEFEFEEFEFEFEFEEFEE PEPE E EEF 
7+ jump table for Flash_func + 
PHEEAFAFEFFAFHEEEEFEFEFEEFEEEEFEEEFEEFEEFEFEEEFEEEEE EEF EE EEF 
jmp_tbl: 

.word Read —- cmd_jmp 

-word Program —- cmd_jmp 

.word Erase — cmd_jmp 

.word All_erase - cmd_jmp 

-word Clear_SRD - cmd_jmp 

.word Read_LB - cmd_jmp 


-word Program_LB - cmd_jmp 
.word LB_enable - cmd_jmp 
.word LB_disable - cmd_jmp 
-word Download - cmd_jmp 


-word Boot_output - cmd_jmp 
-word Read_check - cmd_jmp 


PEELE FELEFEEEFELEFELEFELEFELE FALE FELEFEELE EEE E EEE HE EEE HE PEPE HH 
7+ jump table for SIO_rcv_first_data + 
PEELE HEAEEFHEEEFFEEFEEEF EEE FEEEFEEFFFEEFFEEFFEEFFEEF FPF HEHEHE FEF 
jmp_tbl_2: 
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.word SIO_3 - SIO_cmd_jmp_2_1 

.-word STO_259 - SIO_cmd_jmp_2_1 
.-word SIO_4 - SIO_cmd_jmp_2_1 

.-word SIO_2 - SIO_cmd_jmp_2_1 

-word STO_rcv_end - SIO_cmd_jmp_2_1 
.word SIO_3 - SIO_cmd_jmp_2_1 
-word SIO_4 - SIO_cmd_jmp_2_1 
.word STO_rcv_end - SIO_cmd_jmp_2_1 
.-word STO_rcv_end - SIO_cmd_jmp_2_1 
.word STO_rcv_end - SIO_cmd_jmp_2_1 
.word SIO_3 - SIO_cmd_jmp_2_1 
.word STO_rcv_end - SIO_cmd_jmp_2_1 
.word STO_rcv_end - SIO_cmd_jmp_2_1 
.word STO_rcv_ID_check - SIO_ 
.word STO_rcv_end - SIO_cmd_jmp_2_1 


’ 


, 


cmd_jmp_2_1 


a 
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Read 
Program 
erase 

All erase 
Clear SRD 
Read LB 

LB Program 
LB enable 
LB disable 
Download 
Boot output 
Read check 
Read SRD 

; ID check 
Version out 


Fils ris ois ois iss ie i in i i i i i LC i 
jt serch table for Flash_func, SIO_rcev_first_data + 
Foils Sis ois ois isis i i i i LL 


Index_tbl: 
-byte Offh ; Read(ffh) 
-byte 041h ; Program(41h) 
-byte 020h ; Erase (20h) 
-byte Oa7h All_erase (a7h) 
-byte 050h Clear SRD (50h) 
-byte O71h Read LBS (71h) 
-byte O77h LB program (77h) 
-byte O7ah LB enable (7ah) 
-byte 075h LB disable (75h) 
-byte Ofah Download (fah) 
-byte Ofch Boot output (fch) 
-byte Ofdh Read check (fdh) 
-byte 070h Read SRD (70h) 
-byte Of5h ID check (f£5h) 
-byte Ofbh Version output (fbh) 


’ 


FFEFFFFT LEFT F TL EFEFETTEEFFFTTLLEFFFTETLFFFETTPEEEP EE ++ 444 


p+ Subroutine 


Initialize _2 


+ 


ZEEE FTTEEAFFETEFFEFELEEEFEFTEEFEFEETEFEFFFEFEEEFEE ESE + ETH 
Initialize_2: 


’ 


t+ Flash mode set + 
, 
r 
bset fmcer5 User ROM select 
bcelr fmerl Flash entry bit clear 
bset fmerl Flash entry bit set (E/W mode) 
, 
r 
pt Blank check + 
r 
lde.w Offffch, rO0 Reset vector read 
lde.w Offffeh,rl Reset vector read 
and.w ri, £0 rO & rl 
cmp .w #O0ffffh, r0 rO=ffffh ? 
jne blank_end 
bset sxr10 check complete at r0=ffffh 
bset srll 
bset blank blank flag set 
blank_end: 
r 
it UART1 + 
r 
Initialize_21: 
pee = UART1 transmit/receive mode register 
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bset busy , busy "“"H" 

bset busy_d ; busy output 

mov.b #0,ulcl ; transmit/receive disable 
mov.b #0,ulmr ; ulmr reset 


mov.b #00001001b, ulmr 


i || | | | +++------- clock synchronous SI/O 
; I] | |+ xternal clock 
; +4+4+ fixed 
, 
pases UART1 transmit/receive control register 0 
v 
mov.b #00000100b, ulcO 
; I] || [++ f1 select 
i I} || + RTS select 
i | | |+---------- CTS/RTS enabled 
; | | +----------- CMOS output (TxD) 
; | +------------ falling edge select 
. +=S3252S533==2 LSB first 
, 
(==> UART transmit/receive control register 2 


mov.b #00000000b, ucon 


, I] ||| j++ SSS Transmit buffer empty 

; || | [++ HSRRS Sse Continuous receive mode disabled 
; | | ++ SoSSsesSs5 CLK/CLKS normal 

; | +------------ CTS/RTS shared 

7 oh fixed 

, 

| aa UART1 transmit/receive control register 1 


mov.b #00000101b, ulcl 


; I || +------ Transmission enabled 
; II || + Reception enabled 

; +4444 fixed 

, 

, 

7+ Timer Al + 

, 

set_TAO 

pom eas Timer Al mode register 


mov.b #00000010b, taOmr 


; || || |++------- One-shot mode 
; I} || + Pulse not output 
; | |+ One-shot start flag 
: | | +------------ fixed 
: ++ f1 select 
, 
mov.b #0,ta0ic ; clear TAO interrupt flag 
mov.w #6000-1,ta0 ; set 300 usec at 20 MHz 
bset ta0s 
, 
Les 
v 
, 
yt FLASH function main + 
, 
Flash_func: 
btst tout_flg 
jc Flash_func_end 
bclr ta0s 
mov.b cemd_d, r01 ; veceive data > rOl 
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mov.b #0ch, r0h 

and.b SRD1,r0h 

cmp.b #0ch,r0h 

jne Command_check_2 
mov.w #12,a0 


’ 


Command_check: 


#00001100b srl10,11 mask data 


sr10,11 pick up 
ID check OK? 
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jump Command_check_2 at ID unchecked 


lde.b Index_tb1l-Trans_TOP1+Ram_progTOP-1[a0],r0Oh 


cmp.b r0h, r01 
jeq cmd_jmp_1 
sbjnz.w #1,a0,Command_check 
jmp Command_check_2 
r 
cmd_jmp_1: 
shl.w #1,a0 
lde.w 


cmd_jmp: 

jmpi.w x0 
r 
Command_check_2: 


jmp_tbl-Trans_TOP1+Ram_progTOP-2[a0],r0 


?: cmp.b #070h, r01l ; Read SRD (70h) 
jne P+ 
jmp Read_SRD 
?: cmp.b #0f£5h,r01 ; ID check (f5h) 
jne P+ 
jmp ID_check 
?: cmp.b #O0fbh, r0l ; Version out (fbh) 
jne Flash_func_end 
jmp Ver_output 
r 
Flash_func_end: 
ros 
, 
r 
pt Read + 
r 
Read: 
mov.w #0,4r3 ; receive number 
mov.b #0,addr_1 ; addr_l = 0 
Read_loop: 
add.w #1,4r3 ; v3 +1 increment 
mov.w r3,a0 e 73 > ad 
mov.w data[a0],r0 
mov.b r01l,addr_1[a0] ; Store address 
cmp .w 27:3 e263! = 22.42 
jltu Read_loop 7 jump Read_loop at r3<2 
mov.w OOffh, r2 ; Read array command 
jsr Command_write ; command_write 
bset send_flg 
mov.w 3, start_ent 
mov.w 258, send_cnt 
jmp Flash_func_end ; jump Flash_func_end 
, 
r 
7+ Program + 
r 
Program: 
mov.w #0,4r3 ; receive number 
mov.b #0,addr_1 ; addr_l = 0 
mov.w sum, cred ; for Read check command 


Program_loop_1: 
add.w #1,xr3 
mov.w r3,a0 
mov.b data[a0],r0l 


r3 +1 increment 
r3 --> ad 
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mov.b r01,addr_1 [a0] 
cmp .w 259,43 
jltu Program_loop_1 
, 
mov.w OOffh, r2 
Sas Command_write 
mov.w 0070h, r2 
apne Command_write 
lde.w alaO],r1l 
mov.w OOffh, r2 
jsr Command_write 
cmp.b 80h, r1l 
jne Program_end 
, 
mov.w 0041h, r2 
jsr Command_write 
mov.w 0,913 
mov.b addr_h,al 
Program_loop_2: 
mov.w r3,a0 
mov.w data[a0],r1 
mov.w addr_1,a0 
ste.w rl, [ala0] 
, 
mov.b rll,crcin 
mov.b rlh,crcin 
r 
add.w #2,addr_1l 
add.w #2,4r3 
cmp .w #255,4r3 
jltu Program_loop_2 


Program_end: 
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Store address 
r3 = 259 ? 
jump Program_loop_1l at r3<258 


Read array command 
command_write 

Read SRD command 
Command write 

SRD read 

Read array command 
command_write 
error check 


Page program command 
command_write 
writing number (r3=0) 


addr_h --> al 
3 --> a0 
data --> rl 


addr_1l,m --> a0 
data write 


for Read check command 


address +2 increment 

writing number +2 increment 
r3 = 255 ? 

jump Program_loop_2 at r3<255 


mov.w crcd, sum for Read check command 
belr send_flg 
mov.w #0, send_cnt 
mov.w #0, start_cnt 
jmp Flash_func_end jump Flash_func_end 
v 
, 
yt Block erase + 
, 
Erase: 
mov.w #1,xr3 receive number (r3=1) 
mov.b #0feh, addr_1 addr_1l = ffh 
Erase_loop: 
mov.w r3,a0 YS ==> 20 
mov.b data[a0],r0l 
mov.b r01,addr_1 [a0] Store address 
add.w Lars r3 +1 increment 
cmp .w 4,x3 r3=4 ? 
jltu Erase_loop jump Erase_loop at r3<4 
cmp.b Od0h, data Confirm command check 
jne Erase_end jump Erase_end at Confirm command error 
mov.w 0020h, r2 Erase command 
jsr Command_write command write 
mov.w 00d0h, r2 Confirm command 
ste.w r2, [ala0] command write 
Erase_end: 
mov.W OOffh, r2 Read array command 
apes Command_write command_write 
belr send_flg 
mov.w 0, send_cnt 
mov.w 0, start_cent 
jmp Flash_func_end jump Flash_func_end 
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’ 


receive data read --> r0 

Confirm command check 

jump All_erase_end at Confirm command error 
Of0000h --> addr 


All erase command 
command write 
Confirm command 


t+ All erase ( unlock block ) + 
All_erase: 
mov.w #1,a0 
mov.b data[a0],r0Ol 
cmp.b #0d0h, r0l 
jne All_erase_end 
mov.w #0000h, addr_1l 
mov.b #000fh, addr_h 
mov.W #00a7h, r2 
jsr Command_write 
mov.W #00d0h, r2 
ste.w r2, [ala0] 


All_erase_end: 


command write 


Read array command 
command_write 


jump Flash_func_end 


receive number (r3=0) 
Of0000h --> addr 


Read array command 
command_write 

Read SRD command 
command write 


Read array command 
command_write 


jump Flash_func_end 


O0f0000h --> addr 


Read array command 
command write 
Clear SRD command 
command write 

Read array command 
command write 

SRD1 clear 


jump Flash_func_end 


receive number (r3=1) 


mov.W #00ffh, r2 
jsr Command_write 
belr send_flg 
mov.w #0, send_cnt 
mov.w #0, start_cnt 
jmp Flash_func_end 
; 
r 
P+: Read SRD + 
r 
Read_SRD: 
mov.w #0,4r3 
mov.w #0000h, addr_1l 
mov.b 000fh, addr_h 
mov.W #00ffh, r2 
jsr Command_write 
mov.w 0070h, r2 
jsr Command_write 
lde.w alaO],rl SRD read 
mov.W #00ffh, r2 
jsr Command_write 
mov.w 1,start_cent 
mov.w 3,send_cnt 
bset send_flg 
jmp Flash_func_end 
; 
r 
pt Clear SRD + 
r 
Clear_SRD: 
mov.w #0000h, addr_1l 
mov.b #000fh, addr_h 
mov.W #00ffh, r2 
jsr Command_write 
mov.W #0050h, r2 
jsr Command_write 
mov.W #00ffh, r2 
jsr Command_write 
and.b #10011100b, SRD1 
mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp Flash_func_end 
; 
r 
pans Read Lock Bit + 
r 
Read_LB: 
mov.W #1,4r3 
mov.b #O0feh, addr_1l 


addr_l = ffh 
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Read_LB_loop: 
mov.w r3,a0 


r3 --> a0 


Store address 
r3 +1 increment 


jump Read_LB_loop at r3<3 
Read LB command 


command write 


Read array command 
command write 


jump Flash_func_end 


mov.b data[a0],r0l 
mov.b r01,addr_1[a0] 
add.w Le eS 
cmp .w ee ate r3=3 ? 
jltu Read_LB_loop 
mov.w 0071h, r2 
jsr Command_write 
lde.w [ala0O],r1 read LB 
mov.w OOffh, r2 
sie Command_write 
Read_LB_end: 
mov.w 1,start_cent 
mov.w 1,send_cnt 
bset send_flg 
jmp Flash_func_end 
v 
, 
p+ Program Lock Bit + 


x 
Program_LB: 

mov.w #1,xr3 

mov.b #0feh, addr_1l 
Program_LB_loop: 

mov.w r3,a0 


receive number (r3=1) 
addr_l = ffh 


r3 --> a0 


Store address 
r3 +1 increment 


jump Program_LB_loop at r3<4 


Confirm command check 
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jump Program_LB_end at Confirm command error 


Program LB command 
command write 
Confirm command 
command write 

Read array command 
command write 


jump Flash_func_end 


Lock disable bit = 0 


jump Flash_func_end 


mov.b data[a0],r0l 
mov.b r01,addr_1 [a0] 
add.w 1,r3 
cmp .w 4,x3 r3=4 ? 
jltu Program_LB_loop 
cmp.b Od0h, data 
jne Program_LB_end 
mov.w 0077h, r2 
jsr Command_write 
mov.w 00d0h, r2 
ste.w r2, [ala0] 
mov.w OO0ffh, r2 
pices Command_write 
Program_LB_end: 
mov.w 0, start_cent 
mov.w 0, send_cnt 
belr send_flg 
jmp Flash_func_end 
v 
, 
yt Lock Bit enable + 
, 
LB_enable: 
bclr fmcr2 
mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp Flash_func_end 
v 
, 
yt Lock Bit disable + 


, 


LB_disable: 


belr fmcr2 

bset fmcr2 

mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 

jmp Flash_func_end 


Lock disable bit = 0 
Lock disable Bit 


ll 
be 


jump Flash_func_end 
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blank flag check 

jump ID_check_end at blank 

lower ID address check 

jump ID_error at ID address error 
higher ID address check 


rt ID check + 
; 
ID_check: 

btst blank 

jc ID_check_end 

cmp .w #0ffdfh, addr_1l 

jne ID_error 

cmp .w #0070fh, addr_h 

jne ID_error 


ID_data_check: 


mov.w #0000fh, al 

mov.W #0ffdfh,rl1 

mov.w #1,4r3 
ID_check_loop: 

mov.w r1,a0 

lde.b [ala0],r0l1 

mov.w r3,a0 

cmp.b r01l,data[a0] 

jne ID_error 

add.w #4,4r1 

cmp .w #0ffe7h,r1 

jne P+ 

mov.Ww #0ffebh,r1 
a8 

add.w #1,4r3 

cmp.w #8,4r3 

jltu ID_check_loop 
ID_OK: 

bset sr10 

bset sril 

jmp ID_check_end 
ID_error: 

bset sr10 

bcelr sril 


ID_check_end: 


jump ID_error at ID address error 


ID higher address --> al 
ID lower address --> rl 
check loop number (r3=1) 


rl --> a0 
ID data read from Flash memory 
r3 --> a0 


compare ID data 

jump ID_error at ID error 

rl +4 increment (next ID address) 
rl=O0ffefh ? 

jump ? at not equal 

rl=0ffeb at equal 


r3 +1 increment 
r3=8 ? 
jump ID_check_loop at r3<8 


ID check OK (sr11=1,sr10=1) 
jump ID_check_end 


ID error (sri1=0,sr10=1) 


jump Flash_func_end 


Boot ROM select 
receive number 
addr_l = 0 


r3 +1 increment 
r3 --> a0 


Store address 


jump Read_loop at r3<2 


jump Flash_func_end 


mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp Flash_func_end 
, 
r 
pt Boot output + 
r 
Boot_output: 
belr fmcer5 
mov.w #0,4r3 
mov.b #0,addr_1 
Boot_loop: 
add.w #1,4r3 
mov.w r3,a0 
mov.W data[a0],r0 
mov.b r01l,addr_1[a0] 
cmp .w #2,4r3 r3 =2 ? 
jltu Boot_loop 
bset send_flg 
mov.w #3, start_cnt 
mov.w #258, send_cnt 
jmp Flash_func_end 
a 
r 
t+ Read check at 


’ 


Read_check: 
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mov.w #0, start_cnt 


mov.w #2, send_cnt 
bset send_flg 
jmp Flash_func_end 7 jump Flash_func_end 
, 
, 
yt Download + 
, 
Download: 
boelr fmer5 ; Boot ROM select 
jmp.a Download_program 7 jump Download_program 
, 
, 
p+ Version output + 


, 
Ver_output: 
mov.w #0, start_cnt 


mov.w #8, send_cnt 
bset send_flg 
jmp Flash_func_end 7 jump Flash_func_end 


v 

Fis ois ois is is is Sia st in I i i 
p+ Subroutine : Command write + 
PEFEEEEEEAELEFEFEEEFEEEEEEE FFE EEEEEPEEEE EEF EEE EPPA EEE HEHE EF 
Command_write: 


btst fmcr0 ; RY/BY status check 
yz Command_write 

mov.w addr_1,a0 ; addr_l,m --> a0 
mov.b addr_h,al + addr hi --> al 
ste.w r2, [ala0] ; command write 

CES 


v 

PEELE FEFEFEEEFEEEFEEEFEEEFEFEFEEEFEFEFEEEFEFE FEE EEE EFEEE ETH 
7+ Subroutine : a synchronized signal I/O receive data+ 
PEELE FELEFEEE FEE FEEEFEEEFEEEFEEEFEEEFEEE FEAF FEAF FE EEEFEEE HEH 
SIO_rcv_data: 


jsr set_TAO 
SIO_rcv_data_1: 

btst ir_taOic ; time out error ? 

jne P+ 

jsr Time_over_flg 7 jump Time_over at time out 
2. 

btst ri_ulcl 7 receive complete ? 

jne SIO_rcv_data_l 

mov.w ulrbprcv od ; veceive data read --> r0 

rts 


v 

PEELE FELEFEEEFEEEFEEEFEEEFEEEFEEEFEEEFEEE FEE FEEEEEEE FEE EE ET 
7+ Subroutine : a synchronized signal I/O receive datat+ 
Fi ie is SL i Sn 
SIO_rcv_data_rom: 


jsr set_TAO 
SIO_rcv_data_rom_1: 
btst ir_taOic ; time out error ? 
bmc fmer5 ; time out, User ROM select 
jne P+ 
jsr Time_over_flg 7 jump Time_over at time out 
De. 
btst PLE) 7 receive complete ? 
jne SIO_rcv_data_rom_1 
mov.w ulrb,rev_d ; veceive data read --> r0 
rts 


, 
Fs is sn SL LL 
7+ Subroutine : a synchronized signal I/O send + 
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Fits ois ois ois isis i in oi i i i 
SITO_send: 


jsr set_TAO 

jsr SIO_send_data 
jsr SIO_rcv_data 
rts 


, 

Fr is iss is SL LL 
7+ Subroutine : a synchronized signal I/O send + 
Fr is iss is 
SIO_send_rom: 


jsr set_TAO 

jsr SIO_send_data 

jsr SIO_rcv_data_rom 

res 
, 
; 
;+ Transfer Program -- UART mode a 
Peg (1) Main flow + 
pt (2) Flash control program + 
z+ Read, Program, All_erase,Read_SRD,Clear_SRD + 
z+ (3) Other program + 
jt ID_check + 
Vy 
; 

.org Trans_TOP2 


, 
FAEFEEAAFEEEE EEE FEEL EEE EEF EFEFEEEFE FEF EFEEEFEE EEE EEF HH EH4 
z+ Main flow - UART mode - + 
FAFEEAAEEEE EEE E FEEL EEE EEF EFEEEEEEE EEE FEEEFEE EEE HEF H +444 
U_Main: 

jmp U_SIO_init_first 
; 
U_Loop_main: 

mov.b SRD1,SRD1_bak 7 SRD1 back up 

mov.b SRD1,SRD1_bak+2 
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jsr U_SIO_rcv 

mov.w rcev_d,r0 

mov.b r01,cmd_d 

mov.w #0,1r2 

mov.w r2,a0 

mov.b r01,data[a0] 

bcelr cmd_flg 
r 

jmp U_SIO_freq 

jsr U_time_init 

jmp U_SIO_rcv_first_data 
U_Flash_set: 

jmp U_Flash_func 
U_Flash_send: 

jmp U_STO_send_data 
U_Flash_int: 

btst tint_flg 

jne U_Main_end 

jsr TInitialize_31 7 command error,UART mode Initialize 


; 
U_Main_end: 
jmp U_Loop_main 7 jump U_Loop_main 


pt initialize SIO + 
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U_time_init: 


bset rev_flg 
beclr tint_flg 
rts 
, 
, 
i+ SI/O recieve data + 


, 


U_SIO_rcv_first_data: 


btst rcev_flg 
jne U_SIO_rcv_end 
Ic U_SIO_rcev_first_data_set 


U_SIO_rcv_first_data_loop: 


jsr U_SIO_rcv_only 

mov.w rev dy, £0 ; veceive data = £G 
U_SIO_rcev_first_data_set: 

mov.w r2,a0 


mov.b r01,data[a0] 
add.w #1,r2 


btst cmd_flg 
1¢ U_SIO_loop_chk 
bset cmd_flg 


mov.b r01,cmd_d 


mov.w #19,a0 

U_SIO_rcev_command_chk: 
lde.b U_Index_tbl-Trans_TOP2+Ram_progTOP-1[a0],r0Oh 
cmp.b r0Oh, r0l 


jeq U_STO_cmd_jmp_2 
sbjnz.w  #1,a0,U_SIO_rcev_command_chk 
jmp U_STO_rcv_end 
U_STO_cmd_jmp_2: 
shl.w 1,a0 
lde.w U_jmp_tb1_2-Trans_TOP2+Ram_progTOP-2[a0],r0 
U_SIO_cmd_jmp_2_1: 
jmpi.w r0 
U_SIO_2: 
mov.w 2, loop_cnt 
jmp U_STO_loop_chk 
U_SIO_259: 
mov.w 259, loop_cnt 
jmp U_SIO_loop_chk 
U_SIO_4: 
mov.w 4, loop_cnt 
jmp U_STO_loop_chk 
U_SIO_3: 
mov.w 3, loop_cnt 
jmp U_SIO_loop_chk 
v 
, 
jt ID check SI/O + 


v 

U_SIO_rev_ID_check: 
mov.w #0,xr3 ; receive number (r3=0) 
mov.w #0ffh,al ; ID size (dummy data = ffh) 
mov.b #0,ta0ic 

U_SIO_ID_data_store: 


cmp .w al,xr3 ; v3=al(ID size) 

jeq U_SIO_ID_address_check; jump ID_address_check at r3=ID size 
jsr U_SIO_rcv_only 

mov.w rcev_d,r0 
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mov. 
mov. 
add. 
cmp. 
jne 

mov. 
add. 
jmp 


zZzzeog 


r3,a0 
r01l,addr_1[a0] 
#1,4r3 

#4,4r3 
U_SIO_ID_data_store 
data,al 

#4,al 
U_SIO_ID_data_store 


U_SIO_ID_address_check: 


jmp 


’ 


U_SIO_rcv_end 


U_SIO_rcv_end_1: 


bset 
jmp 


tint_flg 
U_SIO_rcv_end 


U_SIO_loop_chk: 
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r3 --> ad 
Store address 
r3 +1 increment 


r3=4 ? 

jump ID_data_store at r3 not= 4 
ID size --> al 

al=al1+4 


jump ID_data_store 


cmp .w loop_cnt, r2 
jltu U_SIO_rcv_first_data_loop 
U_SIO_rcev_end: 
belr cmd_flg 
belr rcev_flg 
jmp U_Flash_set 
, 
; 
p+ SIO_send data + 
; 
U_SIO_send_data: 
btst send_flg 
jnec U_SIO_send_data_end 
mov.b cmd_d,rlh 
cmp.b #O0ffh,r1lh ; Read(ffh) 
jeq U_Read_data 
cmp.b #070h,rih ; Read SRD (70h) 
jeq U_Read_SRD_data 
cmp.b #071h,r1h ; Read LB (71h) 
jeq U_Read_LB_data 
cmp.b #O0fbh,rlh ; Version_output (fbh) 
jeq U_Ver_output_data 
cmp.b #O0fdh,rlh ; Read_check (fdh) 
jeq U_Read_check_data 
cmp.b #O0fch,rlh ; Boot_check (fch) 
jeq U_Boot_data 
cmp.b #0b0h,rlih ; BPS SET (bOh) 
jeq U_BPS_BO_data 
cmp.b #O0b1lh,rilh ; BPS SET (bl1h) 
jeq U_BPS_Bl_data 
cmp.b #0b2h,r1lh ; BPS SET (b2h) 
jeq U_BPS_B2_data 
cmp.b #0b3h,r1h ; BPS SET (b3h) 
jeq U_BPS_B3_data 
jmp U_STO_send_func 


U_Read_check_data: 


mov.Ww #0,4r3 

mov.w sum, rl 
U_Read_check_data_loop: 

mov.b rll1l,send_d 

jsr U_SIO_send 

mov.b rlh,ril 

add.w #1,xr3 

cmp .w #2,43 

jltu U_Read_check_data_loop 
U_Read_check_data_end: 

mov.w #0,sum 


’ 


reset 
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jsr 
jmp 


U_Read_data: 


U_SIO_exit 
U_SIO_send_data_end 


mov.w Oks 
U_Read_data_loop: 

lde.b fala0O],r1l : 

mov.b rl1l,send_d 

jsr U_SIO_send 

add.w Lexr3 

add.w 1,a0 

cmp .w 256;%5 ; 

jne U_Read_data_loop 
U_Read_data_end: 

jsr U_SIO_exit 

jmp U_SIO_send_data_end 


U_Ver_output_data: 


mov.w #0,a0 ; 
U_Ver_output_data_loop: 

mov.b ver[a0],send_d ; 

jsr U_SIO_send 

add.w #1,a0 

cmp .w #8, a0 ; 

jne U_Ver_output_data_loop 
U_Ver_output_data_end: 

jsr U_SIO_exit 

jmp U_SIO_send_data_end 


U_Read_SRD_data: 


mov.w #0,4r3 
U_Read_SRD_data_loop: 

mov.b rll,send_d 5 

jsr U_SIO_send 

mov.b SRD1,r11 ; 

add.w #1,xr3 

cmp .w #2,4r3 ; 

jltu U_Read_SRD_data_loop; 
U_Read_SRD_data_end: 

jsr U_SIO_exit 

jmp U_SIO_send_data_end 


U_Read_LB_data: 


mov. 
Si 


b 


rl1l,send_d ; 
U_SIO_send 


U_Read_LB_data_end: 


jsxr 
jmp 


U_Boot_data: 


U_SIO_exit 
U_SIO_send_data_end 


belr fmcr5 

mov.w addr_1,a0 

mov.b addr_h,al 

mov.w #0,4r3 
U_Boot_data_loop: 

lde.b fala0O],r1l : 

mov.b rll,send_d 

jsr U_SIO_send 

add.w #1,xr3 

add.w #1,a0 

cmp .w #256,4r3 is 

jne U_Boot_data_loop 
U_Boot_data_end: 

bset fmcer5 

jsr U_SIO_exit 


Flash memory read 


Version address offset 


send_data set 


data transfer 


SRD1 data --> rll 


r3 =2 ? 


jump Read_SRD_loop at r3<2 


data transfer 


Flash memory read 
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jmp U_SIO_send_data_end 
U_BPS_BO_data: 
mov.b buff, data_BPS ; Baud rate 9600bps 
jmp U_BPS_SET_data 
U_BPS_Bl_data: 
mov.b buff+1,data_BPS ; Baud rate 19200bps 
jmp U_BPS_SET_data 
U_BPS_B2_data: 
mov.b buff+2,data_BPS ; Baud rate 38400bps 
jmp U_BPS_SET_data 
U_BPS_B3_data: 
mov.b buff+3,data_BPS ; Baud rate 57600bps 
U_BPS_SET_data: 


mov.b r01,send_d 


jsr U_SIO_send 

jsr U_SIO_exit 

jsr U_blank_end ; UART mode Initialize 
jmp U_SIO_send_data_end 


’ 


U_SIO_send_func: 


mov.W start_cnt,r3 
U_SIO_send_data_loop: 
mov.w r3,a0 


mov.b data[a0],r1l 
mov.b rll,send_d 


jsr U_SIO_send 
add.w #1,4r3 
cmp .w send_cnt,r3 ; v3 = send_cnt ? 
jne U_SIO_send_data_loop 
mov.w £3, £0 
U_SIO_send_data_end: 
belr send_flg 
jmp U_Flash_int 


’ 


FEEFFHTTTLFFFTELEEFEFETTLEFFFETTLEFFETELEFFFETEEEEFE EE ++ 444+ 


7+ jump table for Flash_func + 
FEAFHEEAFFEEAFEFAFEFEFEFEFEEEE EEF EEE EEEEEEEEEAEEEEFEEEE HEPAT 
U_jmp_tbl: 

.word U_Read - U_cmd_jmp 

.word U_Program -— U_cmd_jmp 

.word U_Erase -— U_cmd_jmp 

.word U_All_erase - U_cmd_jmp 

-word U_Clear_SRD - U_cmd_jmp 

.word U_Read_LB - U_cmd_jmp 

.-word U_Program_LB - U_cmd_jmp 

.word U_LB_ enable - U_cmd_jmp 

.word U_LB_ disable - U_cmd_jmp 

.word U_Download - U_cmd_jmp 

.word U_Boot_output - U_cmd_jmp 

.word U_Read_check - U_cmd_jmp 


ere rere errerean see rer seear er cere er eerer erar Teter ree rea. 
ef jump table for SIO_rcv_first_data + 
FEE EETTEEHEEET EE FEEEE TEEPE EET P PPP PP ttt PPP t ttt ttt ttt tt 
U_jmp_tbl_2: 
-word U_SIO_3 - U_STO_cmd_jmp_2_1 ; Read 
-word U_SIO_259 - U_STO_cmd_jmp_2_1 ; Program 
-word U_SIO_4 - U_STO_cmd_jmp_2_1 ; erase 
1 

J 

1 


.word U_SIO_2 - U_SIO_cmd_jmp_2 
.word U_SIO_rcv_end - U_SIO_cmd_jmp_2_1 7 Clear SRD 
.word U_SIO_3 -— U_SIO_cmd_jmp_2 ; Read LB 
.word U_SIO_4 - U_SIO_cmd_jmp_2_1 ; LB Program 
.word U_STO_rcv_end -— U_SIO_cmd_jmp_2 LB enable 
-word U_SITO_rcv_end - U_SIO_cmd_jmp_2_1 ; LB disable 


; All erase 


BR 
. 
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.word 
.word 
.word 
.word 
.word 
.word 
.word 
.word 
.word 
.word 


| STO_rcev_end 


SIO_3 - U_SIO 
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| STO_rcev_end 
| STO_rev_end 


| STO_rcv_ID_che 


| STO_rcev_end 
| STO_rcev_end 
| STO_rcev_end 
| STO_rcev_end 
| STO_rcv_end 


U_STO_cmd_jmp_2_1 7 Download 
cmd_jmp_2_1 7 Boot output 
U_STO_cmd_jmp_2_1 ; Read check 


SIO_cmd_jmp_2_1 ; Read SRD 

ck - U_SIO_cmd_jmp_2_1 ; ID check 
STO_cmd_jmp_2_1 , Version out 
SIO_cmd_jmp_2_1 7  U_BPS_BO 
SIO_cmd_jmp_2_1 * TUCBPS Bi 
SIO_cmd_jmp_2_1 3; ULBPS_B2 
SIO_cmd_jmp_2_1 7  U_BPS_B3 


PEFEEEEEEFELEF FFE FEFEEEEEEE FFE EEEEEEAEEE FAFA EEE HPPA EEE HEHE EF 
ee serch table for Flash_func, SIO_rcev_first_data + 
PEAEEEEEEEELEE EEE FE FEEL E FFE EE EEEPEEEE FEF E EEE HEPA HEHEHE HEF 


U_Index_tbl: 
.byte 
.byte 
-byte 
-byte 
-byte 
-byte 
-byte 
-byte 
-byte 
.byte 
-byte 
-byte 
.-byte 
-byte 
-byte 
-byte 
.byte 
-byte 
-byte 


, 


Offh 
041h 
020h 
Oa7h 
050h 
O71h 
077h 
O7ah 
075h 
Ofah 
Ofch 
Ofdh 
070h 
Of5h 
Ofbh 
Ob0h 
Oblh 
Ob2h 
Ob3h 


Read (ffh) 

Program (41h) 

Erase (20h) 
All_erase (a7h) 
Clear SRD (50h) 

Read LBS (71h) 

LB program (77h) 

LB enable (7ah) 

LB disable (75h) 
Download (fah) 

Boot output (fch) 
Read check (fdh) 
Read SRD (70h) 

ID check (f£5h) 
Version output (fbh) 
BPS_SET 9600 (b0Oh) 
BPS_SET 19200 (b1lh) 
BPS_SET 38400 (b2h) 
BPS_SET 57600 (b3h) 


ZTFLFFFTTLEFEFETTLFFEFETTLFFFEFTEEFFFETTEFEFETEPEFEF EEE + +++ 


yt Subroutine 


Initialize_3 - UART mode + 


PEAEEEEEEEELEF EF FFE FEEL E FFE EEEEEPEEEE EEF EEE EPH EE HEHE HHH 
Initialize_3: 


, 


yt Flash mode set + 
v 
, 
bset fmer5 ; User ROM select 
bolr fmerl , Flash entry bit clear 
bset fmcerl ; Flash entry bit set (E/W mode) 
v 
r 
a Blank check + 
, 
lde.w Offffch, r0 ; Reset vector read 
lde.w Offffeh,rl ; Reset vector read 
and.w r1,r0 p HO &: ED 
cmp .w #O0ffffh, r0 ; cO=ffffh ? 
jne U_blank_end 
bset srl10 ; check complete at r0O=ffffh 
bset srll 
bset blank ; blank flag set 
U_blank_end: 
, 
7+ UART1 + 
r 
pose UART nit rate generator 
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mov.w data_BPS,ulbrg 
r 


Initialize_31: 
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; UART1 transmit/receive mode register 


mov.b #0,ulcl ; transmit/receive disable 
mov.b #0,ulmr ; ulmr reset 
mov.b #00000101b, ulmr 

; I] ||| j++ SSeS SSeS= transfer data 8 bit long 

; || | | |}#------------ Internal clock 

; I] | |+ one stop bit 

: | | ++ parity disabled 

; |+ sleep mode deselected 


mov.b # 


f1 select 

RTS select 

CRT/RTS enabled 
CMOS output (TxD) 
Must always be "0" 


oats! UART transmit/receive control register 2 


mov.b #00000000b, ucon 


mov.b # 


rts 


Transmit buffer empty 
Invalid 

Must always be 
CTS/RTS shared 
fixed 


wow 


Transmission disabled 
Transmission enabled 
Reception disabled 
Reception enabled 
fixed 


FLASH function main 


’ 


U_Flash_func: 


mov.b cmd_d, r01 

mov.b #0ch, r0Oh 

and.b SRD1,r0h 

cmp.b #O0ch,r0h 

jne U_Command_check_2 
mov.w #12,a0 


U_Command_check: 


; receive data --> rOl 


; #00001100b srl10,11 mask data 

7 sr10,11 pick up 

; ID check OK? 

7 jump Command_check_2 at ID unchecked 


U_Index_tb1-Trans_TOP2+Ram_progTOP-1[a0],r0Oh 


lde.b 

cmp.b rOh, r0l 

jeq U_cmd_jmp_1 

sbjnz.w  #1,a0,U_Command_check 
jmp U_Command_check_2 


U_cmd_jmp_1: 
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shl.w 
lde.w 
U_cmd_jmp: 
jmpi.w x0 


#1,a0 


U_Command_check_2: 
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U_jmp_tb1-Trans_TOP2+Ram_progTOP-2[a0],r0 


?: cmp.b 070h, rOl ; Read SRD (70h) 
jne P+ 
jmp U_Read_SRD 
?: cmp.b Of5h,r01 ; ID check (f5h) 
jne P+ 
jmp U_ID_check 
?: cmp.b ObO0h, r01 ; BPS_SET 9600 (bO0h) 
jne P+ 
jmp U_BPS_BO 
?: cmp.b Oblh, r01l ; BPS_SET 19200 (b1h) 
jne P+ 
jmp U_BPS_Bl 
?: cmp.b Ob2h, r01 ; BPS_SET 38400 (b2h) 
jne P+ 
jmp U_BPS_B2 
?: cmp.b O0b3h, r01 ; BPS_SET 57600 (b3h) 
jne P+ 
jmp U_BPS_B3 
?: cmp.b Ofbh, rOl ; Version out (fbh) 
jne U_Flash_func_end 
jmp U_Ver_output 
, 
U_Flash_func_end: 
jmp U_Flash_send 
v 
, 
yt Read + 
, 
U_Read: 
mov.w #0,xr3 ; receive number 
mov.b #0,addr_1 ; addr_l = 0 
U_Read_loop: 
add.w #1,xr3 ; v3 +1 increment 
mov.w r3,a0 , 93 —-—> ad 
mov.W data[a0],r0 
mov.b r01,addr_1 [a0] ; Store address 
cmp .w 2,X3 - ro = 2 7 
jltu U_Read_loop 7 jump Read_loop at r3<2 
mov.w OOffh, r2 ; Read array command 
jsr U_Command_write ; command_write 
bset send_flg 
mov.w 3, start_ent 
mov.w 258,send_cnt 
jmp U_Flash_func_end 7 jump Flash_func_end 
v 
, 
pak Program + 


; 
U_Program: 


mov.Ww #0,4r3 

mov.b #0,addr_1 

mov.w sum, crcd 
U_Program_loop_1: 

add.w #1,xr3 

mov.w r3,a0 

mov.b data[a0],r0l 

mov.b r01,addr_1 [a0] 

cmp .w #259,4r3 


receive number 
addr_l = 0 
for Read check command 


r3 +1 increment 
r3 --> a0 


Store address 
r3 = 259 ? 
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jltu U_Program_loop_1 
; 
mov.W #00ffh, r2 
jsr U_Command_write 
mov.Ww #0070h, r2 
jsr U_Command_write 
lde.w alaO],rl 
mov.w OOffh, r2 
jsr U_Command_write 
cmp.b 80h, r1l 
jne U_Program_end 
; 
mov.w 0041h, r2 
jsr U_Command_write 
mov.w 0,23 


mov.b addr_h,al 
U_Program_loop_2: 


mov.w r3,a0 
mov.w data[a0],r1l 
mov.w addr_1,a0 
ste.w r1, [ala0] 

r 
mov.b rll,crcin 
mov.b rlh,crcin 


add.w #2,addr_1l 
add.w #2,4r3 
cmp .w #255,4r3 
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jump Program_loop_1l at r3<258 


Read array command 
command_write 

Read SRD command 
Command write 

SRD read 

Read array command 
command_write 
error check 


Page program command 
command_write 
writing number (r3=0) 


addr_h -—> al 
r3 --> a0 
data --> rl 


addr_1l,m --> a0 
data write 


for Read check command 
address +2 increment 
writing number +2 increment 
r3 = 255 ? 


jump Program_loop_2 at r3<255 


for Read check command 


jump Flash_func_end 


jltu U_Program_loop_2 
U_Program_end: 

mov.w crcd, sum 

belr send_flg 

mov.w #0, send_cnt 

mov.w #0, start_cnt 

jmp U_Flash_func_end 
, 
r 
pt Block erase + 
r 
U_Erase: 

mov.w #1,4r3 


mov.b #O0feh, addr_1l 
U_Erase_loop: 

mov.w r3,a0 
mov.b data[a0],r0l 
mov.b r01l,addr_1[a0] 
add.w #1,xr3 
cmp .w #4,43 


jltu U_Erase_loop 
cmp.b #0d0h, data 

jne U_Erase_end 
mov.Ww #0020h, r2 

jsr U_Command_write 


mov.W #00d0h, r2 

ste.w r2, [ala0] 
U_Erase_end: 

mov.W #00ffh, r2 


jsr U_Command_write 
belr send_flg 

mov.w #0, send_cnt 
mov.w #0, start_cnt 

jmp U_Flash_func_end 


receive number (r3=1) 
addr_l = ffh 


r3 --> ad 


Store address 

r3 +1 increment 

r3=4 ? 

jump Erase_loop at r3<4 
Confirm command check 


jump Erase_end at Confirm command error 
Erase command 

command write 

Confirm command 

command write 


Read array command 
command_write 


jump Flash_func_end 
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rt 


All erase 


( unlock block ) 
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, 


U_All_erase: 


mov. 
mov. 
cmp 
jne 
mov. 
mov. 
mov. 
jsr 

mov. 
Sie 


Ww 
b 


#6 


WwW 


-W 


1,a0 
data[a0],r0l 
Od0h, r0l 
U_All_erase_end 
0000h, addr_1 
000fh, addr_h 
O0a7h, r2 
U_Command_write 
00d0h, r2 

r2, [ala0] 


U_All_erase_end: 


receive data read --> r0 

Confirm command check 

jump All_erase_end at Confirm command error 
0f0000h --> addr 


All erase command 
command write 
Confirm command 
command write 


rt 


, 


mov.W OOffh, r2 Read array command 

sxe U_Command_write command_write 

belr send_flg 

mov.w 0, send_cnt 

mov.w 0, start_cent 

jmp U_Flash_func_end jump Flash_func_end 
Read SRD + 

U_Read_SRD: 

mov.w 0,r3 receive number (r3=0) 

mov.w 0000h, addr_1 Of0000h --> addr 

mov.b 000fh, addr_h 

mov.W OO0ffh, r2 Read array command 

pices U_Command_write command_write 

mov.w 0070h, r2 Read SRD command 

ache U_Command_write command write 

lde.w {[alaO],r1 SRD read 

mov.W OOffh, r2 Read array command 

jsxr U_Command_write command_write 

mov.w 1,start_cent 

mov.w 3,send_cnt 

bset send_flg 

jmp U_Flash_func_end jump Flash_func_end 
Clear SRD + 


rt 


, 


U_Clear_SRD: 


mov.w 0000h, addr_1 O0f0000h --> addr 
mov.b O000fh, addr_h 
mov.W OO0ffh, r2 Read array command 
jsr U_Command_write command write 
mov.w 0050h, r2 Clear SRD command 
jsr U_Command_write command write 
mov.W OOffh, r2 Read array command 
jsr U_Command_write command write 
and.b 10011100b, SRD1 SRD1 clear 
mov.w 0, start_cent 
mov.w 0, send_cnt 
beir send_flg 
jmp U_Flash_func_end jump Flash_func_end 
v 
, 
yt Read Lock Bit + 
, 
U_Read_LB: 
mov.w Ly ES receive number (r3=1) 
mov.b Ofeh, addr_1 addr_l = ffh 
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U_Read_LB_loop: 


mov. 
mov. 
mov. 
add. 
cmp. 
jltu 
mov. 
jsr 

lide. 
mov. 
jsr 


W 


aS 


WwW 


Ww 
Ww 


r3,a0 
data[a0],r0l 
r01l,addr_1[a0] 
#1,4r3 

#3,4r3 
U_Read_LB_loop 
#0071h, r2 
U_Command_write 
[ala0O],r1 
#00ffh, r2 
U_Command_write 


U_Read_LB_end: 


r3 --> ad 


Store address 
r3 +1 increment 
r3=3 ? 


jump Read_LB_loop at r3<3 


Read LB command 
command write 
read LB 


Read array command 


command write 


jump Flash_func_end 


receive number (r3=1) 


addr_l = ffh 


r3 --> ad 


Store address 
r3 +1 increment 
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jump Program_LB_loop at r3<4 


Confirm command check 


jump Program_LB_end at Confirm command error 


Program LB command 


command write 
Confirm command 
command write 


Read array command 


mov.w #1,start_cnt 
mov.w #1,send_cnt 
bset send_flg 
jmp U_Flash_func_end 
, 
r 
pt Program Lock Bit + 
r 
U_Program_LB: 
mov.w #1,xr3 
mov.b #0feh, addr_1l 
U_Program_LB_loop: 
mov.w r3,a0 
mov.b data[a0],r0l1 
mov.b r01l,addr_1[a0] 
add.w 1x3 
cmp .w 4,x3 r3=4 ? 
jltu U_Program_LB_loop 
cmp .b Od0h, data 
jne U_Program_LB_end 
mov.w 0077h, r2 
jsr U_Command_write 
mov.w 00d0h, r2 
ste.w r2, [ala0O] 
mov.W #00ffh, r2 
jsr U_Command_write 


U_Program_LB_end: 


command write 


jump Flash_func_end 


mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp U_Flash_func_end 
, 
r 
z+ Lock Bit enable + 


U_LB_enable: 


Lock disable bit 


jump Flash_func_end 


belr fmcr2 
mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp U_Flash_func_end 
, 
r 
z+ Lock Bit disable + 


’ 


U_LB_disable: 


belr 
bset 


mov .w 


mov .w 


bcelr 


fmcr2 

fmcr2 

#0, start_cnt 
#0, send_cnt 
send_flg 


Lock disable Bit 
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Lock disable bit = 


jmp 


U_Flash_func_end 
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jump Flash_func_end 


yt ID check 


U_ID_check: 


btst blank ; blank flag check 
1¢ U_ID_check_end 7 jump ID_check_end at blank 
cmp .w Offdfh, addr_1l ; lower ID address check 
jne U_ID_error 7 jump ID_error at ID address error 
cmp .w 0070fh, addr_h ; higher ID address check 
jne U_ID_error 7 jump ID_error at ID address error 
U_ID_data_check: 
mov.w 0000fh,al ; ID higher address --> al 
mov.w Offdfh,rl ; ID lower address --> rl 
mov.w Les ; check loop number (r3=1) 
U_ID_check_loop: 
mov.w r1l,a0 ; rl --> ad 
lde.b f[ala0O],r0l ; ID data read from Flash memory 
mov.w r3,a0 % LS. => 20 
cmp.b r01,data[a0] 7 compare ID data 
jne U_ID_error 7 jump ID_error at ID error 
add.w 4,xr1 ; rl +4 increment (next ID address) 
cmp.w Offe7h, rl ; vl=O0ffefh ? 
jne 2+ 7 jump ? at not equal 
mov.w Offebh,rl , vl=O0ffeb at equal 
2. 
add.w Ly tS ; r3 +1 increment 
cmp .w 8; £3 ; v3=8 ? 
jltu U_ID_check_loop 7 jump ID_check_loop at r3<8 
Lhe Ort 
bset sxr10 
bset srl1l ; ID check OK (sril=1,sr10=1) 
jmp U_ID_check_end 7 jump ID_check_end 
U_ID_error: 
bset sr10 
belr srll ; ID error (sr11=0,sr10=1) 
U_ID_check_end: 
mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp U_Flash_func_end ; jump Flash_func_end 
v 
, 
7+ Boot output it 


U_Boot_output: 


boly fmer5 ; Boot ROM select 
mov.w #0,xr3 ; receive number 
mov.b #0,addr_1 ; addr_l = 0 
U_Boot_loop: 
add.w #1,xr3 ; v3 +1 increment 
mov.w r3,a0 * rs ==> at 
mov.W data[a0],r0 
mov.b r01,addr_1 [a0] ; Store address 
cmp .w #2,4r3 3; r3 =2? 
jltu U_Boot_loop 7 jump Read_loop at r3<2 
bset send_flg 
mov.w #3, start_cnt 
mov.w #258, send_cnt 
jmp U_Flash_func_end 7 jump Flash_func_end 
v 
, 
yt Read check + 
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’ 


U_Read_check: 


mov.w #0, start_cnt 

mov.w #2, send_cnt 

bset send_flg 

jmp U_Flash_func_end 7 jump Flash_func_end 
, 
r 
t+ Download + 


U_Download: 


belr fmer5 ; Boot ROM select 

jmp.a U_Download_program ; jump Download_program 
; 
; 
pt Version output + 


i 
U_Ver_output: 
mov.w #0, start_cnt 


mov.w #8, send_cnt 
bset send_flg 
jmp U_Flash_func_end 7 jump Flash_func_end 


, 

Fits cis ois Sis isis i i 
pt Subroutine : Command write + 
PEE E AFF E EEE EE EEE EEEEEEEAEE FFF EEEPEAAE EAH HEHEHE HP H+4 
U_Command_write: 


btst fmcr0 ; RY/BY status check 
jz U_Command_write 
mov.w addr_1,a0 ; addr_1l,m --> a0 
mov.b addr_h,al ; addr_h --> al 
ste.w r2, [ala0] ; command write 
Les. 

, 

r 

pt Main Init first - UART mode - + 


’ 


U_SIO_init_first: 


belr freq_set0O ; freq set flag clear 
bclr freq_setl 
bclr freq_set2 
mov.b #100,data_BPS ; 9600bps for 16MHz 
jsr Initialize_3 ; UART mode Initialize 
jsr U_SIO_rcv 
mov.w rev d,ro 
cmp.b #0b0h, r0l 
jeq U_Freq_Get1 
cmp.b #0f£4h, rOl 
jne U_Freq_Get3 
,s-S5== 10MHz H 
mov.b #64, buff ; 9600bps 
mov.b #32,buff+1 ; 19200bps 
mov.b #15, buff+2 ; 38400bps 
mov.b #10, buff+3 ; 57600bps 
mov.b #0b0h, r01 
jmp U_Freq_Get2 
= ==S= 16MHz : 
U_Freq_Getl1: 
mov.b #103,buff ; 9600bps 
mov.b #50, buff+1 ; 19200bps 
mov.b #25, buff+2 ; 38400bps 
mov.b #17, buff+3 ; 57600bps 
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, 

U_Freq_Get2: 
mov.b #0b0h, r0l 
mov.b buff, data_BPS 


jsr U_blank_end ; UART mode Initialize 
bset freq_set0O , “"BOh" get flag set 
mov.b #0b0h, cmd_d 

jmp U_Flash_set 


, 
U_Freq_Get3: 
mov.b #80h, data_BPS 


mov.b #01000000b, r11 ; counbterl,2 reset 
mov.b #10000000b,r1h 
jsr U_blank_end 
jmp U_Loop_main 
v 
, 
;+ SIO Init - UART mode - + 
, 
U_SIO_freq: 
btst freq_set2 , freq fixed ? 
jc U_SIO_rcev_first_data_set ; jump Command_check_2 at data 
btst freq_set0O 
jz U_Freq_check 7 jump U_Freq_check 
cmp.b #00h, rOl ; "OOh" get? 
bmgtu freq_set2 
jne U_SIO_rcv_first_data_set 7 jump U_Freq_check 
bcelr freq_set0O 
mov.b Offh, r0l ; Gummy data set 
mov.b 01000000b, r11 ; counbterl,2 reset 
mov.b 10000000b, r1lh 
mov.b 80h, data_BPS 
jmp U_Freq_check 
, 
yt Baud rate change - UART mode + 
, 
U_BPS_BO: 
U_BPS_B1: 
U_BPS_B2: 
U_BPS_B3: 
mov.w #0, start_cnt 
mov.w #1,send_cnt 
bset send_flg 
jmp U_Flash_func_end ; jump Flash_func_end 


, 
FHFEAFEFEFFAFEEFAFEEEFEEFEEFEFEEEFEEFEEFEFEFEFEEFEEFEFEE EET 
pt Freq check - UART mode - - 
FHPEAFAFEFFEAFEEFEAFEEEEFEFEEEEFEEEFFEFEEFEFEFEFFEFEE PEPE EE EH 
U_Freq_check: 


belr re_ulcl ; Reception disabled 
btst 8,r1 ; counter = 8 times 
1¢ U_Freq_check_4 
, 
btst freq_setl 
\¢ U_Freq_check_1 
cmp.b #00h, rOl > “00h? 
jeq U_Freq_check_3 
jmp U_Freq_check_2 
U_Freq_check_1: 
btst L3y eu ; fer_ulrb 
jz U_Freq_check_3 
U_Freq_check_2: 
or.b pagel cirts ateal le ; cll = counterl or counter2 
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U_Freq_check_3: 


xor.b data_BPS,r1l 
mov.b r11,data_BPS 
mov.b rlh,ril 

rot.b #-1,r11 

rot.b #-1,rl1h 

rot.b #-1,r11 

jmp U_Freq_check_6 


’ 


U_Freq_check_4: 


btst freq_setl 

ke: U_Freq_set_l 

bset freq_setl 

cmp.b #00h, rO0l 

jeq U_Freq_check_5 

xor.b data_BPS,rih 

mov.b rilh,data_BPS 
U_Freq_check_5: 

mov.b data_BPS, data_BPS+1 

mov.b #01000000b, r11 

mov.b #10000000b,r1h 

mov.b #01111111b, data_BPS 
U_Freq_check_6: 

jsr U_blank_end 
2 

btst p6_6 

jz o> 

bset re_ulcl 

jmp U_Loop_main 


’ 


U_Freq_set_1: 


btst 13,xr0 

jz U_Freq_set_2 

xor.b data_BPS,rih 

mov.b rilh,data_BPS 
U_Freq_set_2: 

bset freq_set2 

mov.b data_BPS+1,r11 

sub.b data_BPS,ril 

shl.b #-1,r11 

add.b data_BPS,ril 
r 

mov.b r11,buff 

shl.b #-1,r11 

mov.b rll1,buff+1 

shl.b #-1,r11 

mov.b rl1l,buff+2 

mov.b buff, r01l 

mov.b #0,r0h 

divu.b #6 

mov.b r01l,buff+3 

mov.b buff, data_BPS 

mov.b #0b0h, r0l 

jsr U_blank_end 

jmp U_BPS_SET_data 


’ 
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; Baud = Baud xor rll 
; data set 


counter sift 


Min-Baud get ? 
Yes , finished 


"00h"? 


; Min Baud --> datatl 
counter reset 


; Reset 


UART mode Initialize 


Reception enabled 


fer_ulrd 


9600bps 
19200bps 


38400bps 


57600bps 


"BOh" set 
UART mode Initialize 


FTEFFFF FLEET THLE FEFETTLEFFFTTLLEFFFTTLEFFFETTEEEFEE EE ++ 444+ 


serial I/O send — UART mode + 


FEET TTLEFEFTTTLFFEFETTLEFFFETELEFFETELEFFFETEPEFEF EE +++ 4+ 


z+ Subroutine 
U_SIO_send: 
belr re_ulcl 
bset te_ulcl 
mov.b send_d,ultb 


transmit buffer register 
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btst 
jne 
res 


?- 


, 


ti_ulcl ; 
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transmit buffer empty? 


ZTFEAFHFTLLFEFETTLFFEFE TT LFFFFTTEEFFFETEEFEFETEPEFEF EET P +++ 


rt 


Subroutine : 


serial I/O send UART mode + 


ZEFLFFHTTTLFEFETTLFFEFETTLEFFETEEEEFFTTTEFEFETE PEF EET + +++ 


U_SIO_send_only: 
mov.b 


btst 
jne 
rts 


2?- 


send_d,ultb ; 


ti_ulcl ; 


transmit buffer register 


transmit buffer empty? 


pTFEFFFTTLEFEFETTLEFEFETELFFFETTEEFFFTTTEFEFETEPEEEE TEP +444 


pt Subroutine : serial I/O receive - UART mode + 
PEE EFAEEEAFEAEFFEEFEEEFEAEEEFEEFAFFEEAFHEEF HAF HAH HHT 
U_SIO_rcv: 

bcelr te_ulcl 

bset re_ulcl 
23: 

btst et le. 7 receive complete? 

jne ?- 

mov.w ulrb, rcv_d 

cls 


a 


ZTHEFFFTTLAFEFETHTLEFEFETTLFFFETTLLFFFET TEEPE TE PEEP E EPP +++ 


rt 


Subroutine : 


serial I/O receive - UART mode + 


ZTFEFFFTTLEFEFETHTLFFEFETTLFFFETEELEFFEETEFEFETEPEFEF EE +++ 44+ 


U_SIO_rcv_only: 
oe 
btst 
jne 2- 
mov.W 
rts 


Pa hed. ; receiv 


complete? 


ulrs, rev id 


ois Bia DLL LL i nn i ln i ln i i i 
Subroutine : 


serial I/O receive - UART mode + 


PTFE FFHTTLEFEFETTLFFAFETTLFFFETTLEFFFETTEFEFETEPEFEF EET +444 


U_SIO_exit: 


btst txept_ulc0d 
jne U_SIO_exit 
rts 


Vector Table 


-section 
.org 
.lword 


.org 
.lword 


.lword 


.end 


inter, romdata 
Vector+ (5*4) 
Reset | 0££000000h ; 


Vector+ (7*4) 
Reset | 0£f000000h ; 
Reset ; Reset 
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Header 


PRR RRR KKK KKK RK KKK KK EK KE KK KKK KEK KK KK KKK KEK KKK KERR KKK KEK ER 


;* file name : definition of M16C/62 Flash *: 


PRR RRR KKK KKK RK KKK KK EK KR KK KKK KEK KR KKK KKK KEK KK EK KEK KKK KK EKER 


v 


; BUSY output 


busy -btequ 4,03ECh 7 p6_4 
busy_d -btequ 4,03EEh 7 pde_4 


’ 


’ 


; Serial I/O select bit 


’ 


s_mode -btequ 5,03ECh - p65 
s_mode_d -btequ 5,03EEh 7 pdéeé_5 
| 
i 
H define of symbols 
; 
Ram_TOP .equ 000400h 
Ram_END .equ OOfffh 
Istack .equ 003000h 
; 
Version .equ Ofe000h 
Boot_TOP .equ Ofe020h 
Trans_TOP1 .equ Ofe310h 
rans_END1 .equ Ofeb90h 
Trans_TOP2 .equ Ofed00h 
rans_END2 .equ Off630h 
Vector .equ Offfdch 
; 
Download_program .equ Ofe200h 
U_Download_program .equ Ofe270h 
; 
SB_base .equ 000400h 
Ram_progTOP .equ 000600h 
Ram_progEND .equ 000e00h 
i 
.section memory, data 
-Org Ram_TOP 
; 
SRD: -blkb 1 
SRD1: -blkb 1 
ver: -blkb 10 
SF: -blkb 1 
unuse: -blkb 4 
addr_l: -blkb 1 
addr_m: -blkb A 
addr_h: -blkb 1 
data: -blkb 300 
buff: -b1lkb 20 
ID_err: -b1lkb al 
sum: -blkb 2 
; 
rcev_d: -blkb 2 
send_d: -blkb 1 
tfig: -blkb 1 
cmd_d: -blkb 1 
loop_cnt: .blkw 1 
send_cnt: -blkw 1 
start_cnt: -blkw I 
SRD1_bak: -blkb 3 
data_BPS: -blkb 2 
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, 


sr0 -btequ 0,SRD 

srl -btequ 1,SRD 

sr2 -btequ 2,SRD 

sr3 -btequ 3,SRD 

sr4 -btequ 4,SRD 

sr5 -btequ 5,SRD 

sr6 -btequ 6,SRD 

sr7 -btequ 7,SRD 

sr8 -btequ 0,SRD1 

sxr9 -btequ 1,SRD1 

sxr10 -btequ 2,SRD1 

srll -btequ 3,SRD1 

sri2 -btequ 4,SRD1 

sxr13 -btequ 5,SRD1 

sxr14 -btequ 6,SRD1 

sr15 -btequ 7,SRD1 

, 

ram_check -btequ 0,SF 

blank -btequ 1,SF 

old_mode -btequ 2,SF 

freq_set0O -btequ 3,SF 

freq_setl -btequ 4,SF 

freq_set2 -btequ 5,SF 

, 

tout_flg -btequ 0,t_flg 

dwn_flg -btequ 1,t_flg 

cmd_flg -btequ 2,t_flg 

send_flg -btequ 3,t_flg 

rev_flg -btequ 4,t_flg 
5,t_flg 


tint_flg -btequ 


, 


138 


M16C/62 Group 
3 3.4 Precautions 


3.4 Precautions 


This section describes precautions to be observed when controlling the M16C/62's internal flash memory. 


When Powering On/Off 


When powering on/off, pay attention to the following: 

(1) Be careful that noise will not get into the control pins (WE, CE, OE). If a noise pulse is applied to the 
control pins when turning the power on or off, a program/erase error will occur, which in the worst case 
may destroy the memory data. 

(2) A finite wait time is required before you can start read or program/erase operation after power-on. 
Specifically, a wait time of 2 us is required before read or program/erase operation can be started after 
Vcc reached Vccmin (3.0 V). 
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4.1 Outline of Hardware 


M16C/80 Group 
4.1 Outline of Hardware 


The M16C/80 group contains DINOR-type flash memory. 
This section shows hardware information about the M16C/80 group which we think is necessary to create a 


boot program. 


Internal Flash Memory Outline 


Table 4.1.1 shows the outline performance of M30800FC/M30802FC of the M16C/80 group. 


Table 4.1.1. Outline Performance of M30800FC and M30802FC 


Power supply voltage 


5V version: 
f(XIN)=20MHz, without wait, 4.2V to 5.5V 
f(XIN)=10MHzZ, without wait, 2.7V to 5.5V (under planning) 


Program/erase voltage 


5V version: 4.2V to 5.5 V 
f(XIN)=12.5MHz, with one wait 
f(XIN)=6.25MHz, without wait, 2.7 to 5.5V 


Flash memory operation mode 


Three modes (parallel I/O, standard serial I/O, CPU rewrite) 


Erase block 
division 


User ROM area 


See Figure 4.1.1 


Boot ROM area 


One division (8 Kbytes) (Note 1) 


Program method 


In units of pages (in units of 256 bytes) 


Erase method 


Collective erase/block erase 


Program/erase control method 


Program/erase control by software command 


Protect method 


Protected for each block by lock bit 


Number of commands 


8 commands 


Program/erase count 


100 times 


ROM code protect 


Parallel I/O and standard serial modes are supported. 


Note: The boot ROM area contains a standard serial I/O mode control program which is stored in 
it when shipped from the factory. This area can be erased and programmed in only parallel 
1/0 mode. 
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Memory Map 


The user ROM of M30800FC has six blocks as block 0 to block 5 and that of M30803FC has seven blocks 
as block 0 to block 6. Figure 4.1.1 shows the memory map. 


OFC000016 
Block 6 : 64K bytes 
OFD000016 
Block 5 : 64K bytes 
OFE000016 
Block 4 : 64K bytes Note 1: The boot ROM area can be rewritten in 
only parallel input/output mode. (Access 
to any other areas is inhibited.) 
Note 2: To specify a block, use the maximum 
OFF000016 address in the block that is an even 
Block 3 : 32K bytes address. 
Flash memory | Flash memory 
i FF; 1 
size an OFF800016 Block 2 : 8K bytes 
128Kbytes 16 
: ere nuns Block 1 : 8K bytes 
256Kbytes OFC000016 OFFC00016 Block 0 : 16K bytes OFFE00016 icetes 
——— OFFFFFF16 OFFFFFF16 


User ROM area Boot ROM area 


Figure 4.1.1 Memory Map 
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Related Register Configuration 


Figure 4.1.2 shows related registers for making user boot program. 


Flash memory control register 0 
b7 b6 bS b4 b3 b2 bi b0 Symbol Address When reset 


XM Jo] | Ty | FMRO 037716 XX0000012 


ror bor boat ida ca 0: Busy (being written or erased) 
rere s. 1: Ready : 
Poh or ok a kd FMRO1_ |CPU rewrite mode 0: Normal mode 

a; a ee ee en ee select bit (Note 1) (Software commands invalid) 

oe me, ne “Gh 1: CPU rewrite mode 

rr (Software commands acceptable) 


a Lock bit disable bit 0: Block lock by lock bit data is 
a ee a FMR02 

ee ee ees q (Note 2) enabled 

oe ae 1: Block lock by lock bit data is 
foes ci, I) Ul disabled 


a oe FMRO3_ | Flash memory reset bit | 0: Normal operation 
boror (Note 3) 1: Reset 


Lebededoeseeed Must always be set to “O” 


User ROM area select bit (| 0: Boot ROM area is accessed 


i irae piaies Note 4) (Effective in only | 1: User ROM area is accessed 
boot mode) 


Nothing is assigned. 
When write, set "0". When read, values are indeterminate. 


r 
' 
1 
poten eee 


Note 1: For this bit to be set to “1”, the user needs to write a “O” and then a “1” to it in 
succession. When it is not this procedure, it is not enacted in “1”. This is necessary to 
ensure that no interrupt or DMA transfer will be executed during the interval. Use the 
control program except in the internal flash memory for write to this bit. 

Note 2: For this bit to be set to “1”, the user needs to write a “O” and then a “1” to it in succession 
when the CPU rewrite mode select bit = “1”. When it is not this procedure, it is not 
enacted in “1”. This is necessary to ensure that no interrupt or DMA transfer will be 
executed during the interval. 

Note 3: Effective only when the CPU rewrite mode select bit = 1. Set this bit to 0 subsequently 
after setting it to 1 (reset). 

Note 4: Use the control program except in the internal flash memory for write to this bit. 


Flash memory control register 1 
b7 b6 b5 b4 b3 b2 bi b0 


Fofofofo] fojofo] Punt. os7eieXXXOKX: 


---4.-1.1 Reserved bit Must always be set to “0” =o] 
to Flash memory power 0: Flash memory power supply is eo 


supply-OFF bit (Note) connected 
1: Flash memory power supply-off 


Eosiet diet siardecatea Reserved bit Must always be set to “0” 


Note : For this bit to be set to “1”, the user needs to write a “O” and then a “1” to it in 
succession. When it is not this procedure, it is not enacted in “1”. This is necessary to 
ensure that no interrupt or DMA transfer will be executed during the interval. Use the 
control program except in the internal flash memory for write to this bit. 

During parallel I/O mode,programming,erase or read of flash memory is not controlled by 
this bit,only by external pins. 


Figure 4.1.2 Related Register Configuration 
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Flash Control Circuit 
The M16C/80's flash control circuit controls the block erase and page program operations performed on the 
internal flash memory. Operation modes are selected by entering software commands to the flash control 
circuit. The status shows the status of the flash control circuit, as well as the status of program and block 
erase operations performed by the flash control circuit. 
To enter commands to the flash control circuit, write the command to flash memory address. 


Software commands 


Flash memory operations are selected by writing a software command to the flash control circuit. The 
table below lists the operations performed by software commands. 


Table 4.1.2 Software Command List 


First bus cycle Second bus cycle Third bus cycle 


Command Data Data Data 
Mode | Address (Do to D7) Mode | Address (Do to D7) Mode | Address (Do to D7) 


Read array i X (Note 6) 


Read status register i SRD (Note 2) 


Clear status register 


Page program (Note 3) i WAO (Note 3)) WDO (Note 3) 
Block erase i BA (Note 4) | D016 


Erase all unlock block i xX D016 


Lock bit program i BA D016 


Read lock bit status i BA De (Note 5) 


Note 1: When a software command is input, the high-order byte of data (Ds to D15) is ignored. 

Note 2: SRD = Status Register Data 

Note 3: WA = Write Address, WD = Write Data 
WA and WD must be set sequentially from 0016 to FE16 (byte address; however, an even address). The page size is 
256 bytes. 

Note 4: BA = Block Address (Enter the maximum address of each block that is an even address.) 

Note 5: De corresponds to the block lock status. Block not locked when De = 1, block locked when De = 0. 

Note 6: X denotes a given address in the user ROM area (that is an even address). 


Flash memory address 


The table below shows the flash memory capacity of each block (address space, number of pages) and 
the block addresses of each block. 


Table 4.1.3 Flash Memory Address 
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Read Array Command (FF 16) 


The read array mode is entered by writing the command code “FF ie” in the first bus cycle. When an even 
address to be read is input in one of the bus cycles that follow, the content of the specified address is read 
out at the data bus (DO—D15), 16 bits at a time. The read array mode is retained intact until another 
command is written. 


Read Status Register Command (7016) 


When the command code “7016” is written in the first bus cycle, the content of the status register is read out 
at the data bus (DO—D7) by a read in the second bus cycle. 
The status register is explained in the next section. 


Clear Status Register Command (5016) 


This command is used to clear the bits SR3 to 5 of the status register after they have been set. These bits 
indicate that operation has ended in an error. To use this command, write the command code “5016” in the 
first bus cycle. 


Page Program Command (4116) 


Page program allows for high-speed programming in units of 256 bytes. Page program operation starts 
when the command code “4116” is written in the first bus cycle. In the second bus cycle through the 129th 
bus cycle, the write data is sequentially written 16 bits at a time. At this time, the addresses A0-A7 need to 
be increased by 2 from “0016” to “FE16.” When the system finishes loading the data, it starts an auto write 
operation (data program and verify operation). 

Whether the auto write operation is completed can be confirmed by reading the status register or the flash 
memory control register 0. At the same time the auto write operation starts, the read status register mode 
is automatically entered. 

After the auto write operation is completed, the status register can be read out to know the result of the 
auto write operation. For details, refer to the section where the status register is detailed. 

The status register bit 7 (SR7) is set to 0 at the same time the auto write operation starts and is returned to 
1 upon completion of the auto write operation. In this case, the read status register mode remains active 
until the Read Array command (FF 16) or Read Lock Bit Status command (7116) is written or the flash 
memory is reset using its reset bit. 

The RY/BY status flag of the flash memory control register 0 is 0 during auto write operation and 1 when 
the auto write operation is completed as is the status register bit 7. 

Figure 4.1.3 shows an example of a page program flowchart. 

Each block of the flash memory can be write protected by using a lock bit. For details, refer to the section 
where the data protect function is detailed. 

Additional writes to the already programmed pages are prohibited. 
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YES 
Check full status 
Page program 
completed 


Figure 4.1.3 Page Program Flowchart 
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Block Erase Command (2016/D016) 


By writing the command code “2016” in the first bus cycle and the confirm command code “D016” in the 
second bus cycle that follows to the block address of a flash memory block, the system initiates an auto 
erase (erase and erase verify) operation. 

Whether the auto erase operation is completed can be confirmed by reading the status register or the flash 
memory control register 0. At the same time the auto erase operation starts, the read status register mode 
is automatically entered, so the content of the status register can be read out. The status register bit 7 
(SR7) is set to 0 at the same time the auto erase operation starts and is returned to 1 upon completion of 
the auto erase operation. In this case, the read status register mode remains active until the Read Array 
command (FF 16) or Read Lock Bit Status command (7116) is written or the flash memory is reset using its 
reset bit. 

The RY/BY status flag of the flash memory control register 0 is 0 during auto erase operation and 1 when 
the auto erase operation is completed as is the status register bit 7. 

After the auto erase operation is completed, the status register can be read out to know the result of the 
auto erase operation. For details, refer to the section where the status register is detailed. 

Figure 4.1.4 shows an example of a block erase flowchart. 

Each block of the flash memory can be protected against erasure by using a lock bit. For details, refer to 
the section where the data protect function is detailed. 


Write 7716 


Write D016 
to block address 


RY/BY status flag 
=1? 


Lock bit program in 
error 


YES 


Lock bit program 
completed 


Figure 4.1.4 Block Erase Flowchart 
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Erase All Unlock Blocks Command (A716/D016) 


By writing the command code “A716” in the first bus cycle and the confirm command code “D016” in the 
second bus cycle that follows, the system starts erasing blocks successively. 

Whether the Erase All Unlock Blocks command is terminated can be confirmed by reading the status 
register or the flash memory control register 0, in the same way as for block erase. Also, the status register 
can be read out to know the result of the auto erase operation. 

When the lock bit disable bit of the flash memory control register 0 = 1, all blocks are erased no matter how 
the lock bit is set. On the other hand, when the lock bit disable bit = 0, the function of the lock bit is effective 
and only unlocked blocks (where lock bit data = 1) are erased. 


Lock Bit Program Command (7716/D016) 


By writing the command code “7716” in the first bus cycle and the confirm command code “D016” in the 
second bus cycle that follows to the block address of a flash memory block, the system sets the lock bit for 
the specified block to 0 (locked). 

Figure 4.1.5 shows an example of a lock bit program flowchart. The status of the lock bit (lock bit data) can 
be read out by a Read Lock Bit Status command. 

Whether the lock bit program command is terminated can be confirmed by reading the status register or 
the flash memory control register 0, in the same way as for page program. 

For details about the function of the lock bit and how to reset the lock bit, refer to the section where the data 
protect function is detailed. 


Write 7716 


Write D016 
to block address 
————s ees 


RY/BY status flag 
=1? 


Lock bit program in 
error 


YES 
Lock bit program 
completed 


Figure 4.1.5 Lock Bit Program Flowchart 


149 


M16C/80 Group 


4.1 Outline of Hardware 


Read Lock Bit Status Command (7116) 


By writing the command code “7116” in the first bus cycle and then the block address of a flash memory 
block in the second bus cycle that follows, the system reads out the status of the lock bit of the specified 


block on to the data (D6). 
Figure 4.1.6 shows an example of a read lock bit program flowchart. 


Write 7116 
Enter block address 


(Note) 
D6 = 02 
YES 
Blocks locked 


Note: Data bus bit 6. 


Blocks not locked 


Figure 4.1.6 Read Lock Bit Program Flowchart 


Data Protect Function (Block Lock) 


Each block in Figure 4.1.1 has a nonvolatile lock bit to specify that the block be protected (locked) against 
erase/write. The Lock Bit Program command is used to set the lock bit to 0 (locked). The lock bit of each 


block can be read out using the Read Lock Bit Status command. 


Whether block lock is enabled or disabled is determined by the status of the lock bit and how the flash 


memory control register 0’s lock bit disable bit is set. 


(1) When the lock bit disable bit = 0, a specified block can be locked or unlocked by the lock bit status (lock 
bit data). Blocks whose lock bit data = 0 are locked, so they are disabled against erase/write. 
On the other hand, the blocks whose lock bit data = 1 are not locked, so they are enabled for erase/ 


write. 


(2) When the lock bit disable bit = 1, all blocks are unlocked regardless of the lock bit data, so they are 
enabled for erase/write. In this case, the lock bit data that is 0 (locked) is set to 1 (unlocked) after 


erasure, so that the lock bit-actuated lock is removed. 
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Status Register 


The status register indicates the operating status of the flash memory and whether an erase or program 
operation has terminated normally or in an error. The content of this register can be read out by only 
writing the read status register command (7016). Table 4.1.3 details the status register. 

The status register is cleared by writing the Clear Status Register command (5016). 

After a reset, the status register is set to “8016.” 

Each bit in this register is explained below. 


Write state machine (WSM) status (SR7) 
After power-on, the write state machine (WSM) status is set to 1. 
The write state machine (WSM) status indicates the operating status of the device, as for output on the 
RY/BY pin. This status bit is set to 0 during auto write or auto erase operation and is set to 1 upon 
completion of these operations. 


Erase status (SR5) 
The erase status informs the operating status of auto erase operation to the CPU. When an erase error 
occurs, it is set to 1. 
The erase status is reset to 0 when cleared. 


Program status (SR4) 
The program status informs the operating status of auto write operation to the CPU. When a write error 
occurs, it is set to 1. 
The program status is reset to 0 when cleared. 
When an erase command is in error (which occurs if the command entered after the block erase com- 
mand (2016) is not the confirm command (D016), both the program status and erase status (SR5) are set 
to 1. 
When the program status or erase status = 1, the following commands entered by command write are not 
accepted. 
Also, in one of the following cases, both SR4 and SR5 are set to 1 (command sequence error): 
(1) When the valid command is not entered correctly 
(2) When the data entered in the second bus cycle of lock bit program (7716/D016), block erase (2016/ 
D016), or erase all unlock blocks (A716/D016) is not the D016 or FF16. However, if FF16 is entered, 
read array is assumed and the command that has been set up in the first bus cycle is canceled. 


Block status after program (SR3) 
If excessive data is written (obhenomenon whereby the memory cell becomes depressed which results in 
data not being read correctly), “1” is set for the program status after-program at the end of the page write 
operation. In other words, when writing ends successfully, “8016” is output; when writing fails, “9016” is 
output; and when excessive data is written, “8816” is output. 
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Table 4.1.4 Definition of Each Bit in Status Register 


Each bit of Definition 
SRD Status name 


Write state machine (WSM) status Ready Busy 


Reserved 7 
Erase status Terminated in error | Terminated normally 
Program status Terminated in error | Terminated normally 


Block status after program Terminated in error | Terminated normally 


Reserved 


Reserved 


Reserved 


Full Status Check 


By performing full status check, it is possible to know the execution results of erase and program operations. 
Figure 4.1.7 shows a full status check flowchart and the action to be taken when each error occurs. 


Read status register 


_ . Execute the clear status register command (5016) 
to clear the status register. Try performing the 
operation one more time after confirming that the 
command is entered correctly. 


. . . Should a block erase error occur, the block in error 
Program error (page|. . . Execute the read lock bit status command (7116) 
or lock bit) to see if the block is locked. After removing lock, 


execute write operation in the same way. If the 


error still occurs, the page in error cannot be 
used. 


_ .After erasing the block in error, execute write 
operation one more time. If the same error still 
occurs, the block in error cannot be used. 


End (block erase, program) 


Note: When one of SR5 to SR is set to 1, none of the page program, block erase, 
erase all unlock blocks and lock bit program commands is accepted. Execute the 
clear status register command (5016) before executing these commands. 


Figure 4.1.7 Full Status Check Flowchart and Remedial Procedure for Errors 
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4.2 Developing The Boot Program 


The standard boot program that was built into the boot ROM area of the flash microcomputer when shipped 
from the factory can be used to program/erase the flash memory. In this case, the hardware resources 
(internal functions) used for control are fixed. Therefore, if you want to control flash memory in the way 
suitable for your system, you need to create a boot program for yourself. 

This section shows an algorithm for the boot program (e.g., for erase and program) that you must at least 
have in order to control the flash memory of the M16C/80 group. 


System Example 


By using the internal peripheral function of UARTO and a serial programmer to control flash memory, the 
following shows an example of device connections is shown in Figure 4.2.1. Assignments of internal 
peripheral functions are listed in Table 4.2.1. 


—- 


Clock input CLK1 
BUSY output RTS1(BUSY) 


Data input RxD1 


Data output TxD1 


e- M16C/80 flash = 
memory version 


CNVss 


(1) Control pins and external circuitry will vary according to peripheral unit (programmer). For more 
information, see the peripheral unit (programmer) manual. 
(2) In this example, the microprocessor mode and standard serial I/O mode are switched via a switch 


Figure 4.2.1 Example of Device Connection 


Table 4.2.1 Assignments of Internal Peripheral Functions 


Peripheral function Usage Setting example 


UARTI Used for transfer/receive of serial * Clock synchronous serial I/O 
programmer and data ¢ External clock is used 


Timer AO Used for time-over judgment of serial * One-shot timer mode 
transfer/receive * 300 us(when 20MHz) 
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Flow of The Main Processing 


Figure 4.2.2 shows a flow of the main processing. 
After initializing the CPU, transfer the write control program to RAM. When transfer is finished, jump to 
RAM and execute the write control program from RAM. 


RAM transfer program on ROM Write control program on RAM 


( CPU programming mode) ee pe eee ee 
Initial setting 2 


Initial setting 1 | 


Time out processing 


Transfer to RAM i 


Figure 4.2.2 Flow of The Main Processing 


154 


M16C/80 Group 
4 4.2 Developing The Boot Program 


Initialization 1 (CPU, Memory) 


The CPU and RAM are initialized. Figure 4.2.3 shows a flow of initialization 1. To clear RAM, use of string 
instructions (e.g., SSTR.W) will prove effective. 


Initial setting 1 
Set ISP and SB 


Function select register AO (PSO: address 03B016) 
b 


PETTY tT 


Bot stp teat Set P64 I/O port 
Port 6 (P6: address 03EC16) 


b4 
LET TTT TT 


Pe Set 'H' data 
Port 6 direction register (PD6: address 032C 16) 
b4 


PETE TT 


bisa Jeseeciees Set output port 


RO <— Set initial value 

AI <<— Set top address of RAM 

R3 [i <«— Programing control program size /2+0 
After setting these registers, execute SSTR.W 


Set 'H" to BUSY pin 


RAM clear 


Protect register (PRCR: address 000A16) 


b1 b0 


i a 


i. System clock write enabled 
+---- Processor mode register write enabled 


System clock control register 0 (CMO: address 000616) 


b7 b6 b5 b4 b3 b2 b1 b0 


| 9} of 0] 0] 1/0] o[o| 


System clock control register 1(CM1: address 000716) 


b7 b6 b5 b4 b3 b2 b1 bO 


| 0} of 1] 0] of] ofa | 


System clock control register 1(CM1: address 000C16) 


b7 b6 b5 b4 b3 b2 b1 b0 


Protect release 


Set system clock 
control register 


L.-t..t../..... Divided by-4 mode 
Processor mode register 0(PMO: address 000416) 


b7 b6 b5 b4 b3 b2 b1 b0 


Processor mode register 1(PM1: address 000516) 
b7 b6 b5 b4 b3 b2 bi bO 


HEDBEEee 


Uw ceccecewE eee ceemSccm 1 wait 


Set processor mode 
register 


Set protect 


Figure 4.2.3 Initialization 1 
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Transfer to RAM Area 


The version information of write program and write control program are transferred to RAM. After transferring, 
jump to write control program on RAM. To transfer, use of string instructions will prove effective. 


Figure 4.2.4 shows the algorithm. 


Transfer to RAM 
Transfer version information 


Transfer preparing 


Jump to RAM area 


Figure 4.2.4 Transfer to RAM Area 


Initialization 2 


RoH[__| 


AO [ ~<— Set source address (low-order 16 bits) 


Al [| ~<— Set destination address 
R3 [ <t— Programing control program size /2+a 


Execute SMOVF.W 


~<t— Set source address (high-order 4 bits) 


JMP 


Set of write to Flash memory and initialization of serial communication are executed. To switch erase/write 
mode, clear the flash entry bit (bit 1 of address 37716), then set 1. 


Figure 4.2.5 shows a algorithm. 


Initial setting 2 
Select user ROM area 


Change to CPU rewrite 
mode 


Go to initial setting of 
peripheral function 


Figure 4.2.5 Initialization 2 


Flash control register 0 ( address 037716) 


b7 b6 bS b4 b3 b2 bi bd 


pee ST 


Lc agesemaeeaeacee Select user ROM area 


Flash control register 0 (address 037716) 


b7 b6 bS b4 b3 b2 bi bd 


COS 
a 


eae CPU rewrite mode 
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Initialization 2 (Peripheral Function) 


The peripheral functions used for programming flash memory is initialized. Figure 4.2.6 shows initialization 
of UART1 for data transmit and timer AO for time-out calculation. 


From initial setting 2 


Set UART1 


CEND) 


Function select register AO (PSO: address 03B016) 


b7 b6 bS b4 b3 b2 bit bO 


fh Ne deeeneek ccs P64 peripheral function output (PSLO_4 enabled) 
' beneeden nen eanicne P65 I/O port 
ee P67 TxD1 output 


Function select register BO (PSLO: address 03B216) 


b7 b6 bS b4 b3 b2 bit bd 


Unemnnstenauisies RTS1 output 
UART1 transmit/receive mode register (U1MR: address 036816) 


b7 b6 bS b4 b3 b2 bit bO 


| 0] 9] of +] of of +] 


t.-1--1.. Clock synchronous serial I/O mode 
Lanne nnnneee External clock 


UART1 transmit/receive control register 0 (U1C0: address 036C16) 


b7 b6 bS b4 b3 b2 bi b0 


| of of of of of sfofo) 


: {baba (f1) 
‘ Laneeeee RTS function 
| [eee CTS/RTS function enabled 


Lode ieee cenees TxD CMOS output 
bana n on 2 n-ne eee eee eee LSB first 
UART transmit/receive control register 2 (UCON: address 037016) 


b7 b6 bS b4 b3 b2 bit bO 


' 1 ot 4. &-=£+ (Transfer buffer empty) 
' p SSP reees eset (Continuous receive mode disabled) 
ROW Peel 8 eye CLK1 clock output 

y seibe Sass a close siete CLK normal mode first 

Manne ennenee nee e nen: CTS/RTS shared pin 


UART1 transmit/receive control register 1 (U1C1: address 036D16) 
b7 b6 b5 b4 b3 b2 bi bd 


| of of of of of sof | 


+- Transfer enabled 
Sieh minis Receive enabled 


Timer AO mode register (TAOMR: address 035616) 


b7 b6 bS b4 b3 b2 bi b0 


| of of of of of of so] 


1 +--+-:One-shot timer mode 

= “No pulse output 

lalallala taletatata alate One-shot start flag is valid 
SUSAR RCE nici Satinciets ff 


Timer AO register (TAO: address 034716,034616) 


#6000-1 <t— When 20M#z, 300s 


Figure 4.2.6 Initialization 2 (Peripheral Function) 
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Receiving Commands 


Commands are received from the serial programmer. 

Write dummy data to the transmit buffer, enable reception (the BUSY signal = low ), and wait for data from 
the serial programmer. At the timing of start reception (the BUSY signal = high ), the timer used to check 
data reception time-out is started. When data is not received within 300 usec, a time-out error is judged 
and time-out processing flag is set. 

When command reception flag is set (cmd_flg = "1"), processing jumps to data reception cycle 

number check processing. When it is not set (cmd_flg = "0"), command reception flag is set. After that, 
jump address is set based on the received serial command and processing jumps to the corresponding 
process. When the serial command is not matched, serial initialization flag is set and processing is ended. 
When the number of receive cycle matches to the prescribed number of serial reception command, command 
reception flag is initialized (cmd_flg = "0") and processing is ended. 

Figure 4.2.7 shows a processing flow. 
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nsfer buffer 
ster 


Start one-shot timer 


Is command 
eceive flag set? 


Set command receive 
flag 


| ID command receive | (A) 


Except command Set serial 
initialization flag (a) 


Command except FFh : 
e | Set reception cycle 
ea 


Figure 4.2.7 Data Reception 
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ID Check Receive Process 


ID check data is received. Transferred ID data is saved to RAM. 
Figure 4.2.8 shows a process flow. 


ID check receive 
processing 
Transfer/receive cycles 
r3=0 
Set ID size (a1) 
temporarily 


a 


r=al 


r3=ID size(a1)? 
r3=/al 


Write to transmit buffer 
register 


Reception 
completed? 


Read the receive buffer 
register 


Store reception data to 
RAM 


r3=r3+1 
r3=4 


Set "ID size+4" to al 


End 


Figure 4.2.8 ID Data Receive Process 


Receive Cycle Setting Process 


Data receive cycle is set by referring to transferred serial command. 
Figure 4.2.9 shows process flow. 


Reception cycle setting 


Set the prescribed receive 
cycle to receive cycle buffer 


End 


Figure 4.2.9 Receive Cycle Setting Process 
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Command Processing 


Flash control command is written into memory by referring to received serial programmer command. 
The ID check is checked as to whether it has been completed or not. (ID check completed bits: 

SR10 = 1, SR11 = 1) When the ID check has been completed, decisions are made on commands such as 
page read and page program, and processing branches to the process in the match commands. 

When the ID check has not been completed, decisions are made on 3 types of commands such as ID 
processing, and processing jumps to the process in the match commands. With mismatch commands, 
processing returns to main part. 
Figure 4.2.10 shows processing flow. 


NG 


flag 


Command process 


Time-out processing 


set? 
N 


Read receive buffer 


register 


ID check completed? 


SR1 
OK 


1=12 


ren f[_Pageread__ J} — 
*h_[ Page program J} 
2an_[[—Biockerase J} 
Am _{[ ase al unlock Bods] 
son_{] Crear satus register [] me 
rin [Read ook bi satvS [] pe 
7 [Lock bi program] ee 
2 [ese bivaia —}— 
rn [Toate J} 


70h 
of] Tere | 


FBh Version information 
output 


other 


Figure 4.2.10 Command Processing 
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To read data from the user area in blocks of 256 bytes, read address is stored to RAM and Read Array 
command (FF 16) is written. The address of the read area is changed from xxxx0016 to xxxxFF16, and the 
data following xxxx0016 is transferred in succession. 

Figure 4.2.11 shows processing flowchart. 


Page read 


Receive cycles r3=0 


Set low-order address, 
addr_l=0 


i 


r3=r3+1 


Set reception address 


Read data buffer 


Store reception data to 
address buffer 


13<2 


iL 


r3=2 


Write read array 
command 


Set transfer flag 


End 


Figure 4.2.11 Page Read 
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Page Program 


Data is written into the user area in blocks of 256 bytes. 

Read 258 bytes data from RAM: 2 bytes of address and 256 bytes of write data received from serial 
programer. Status data is read from the flash memory. The read status is checked. When it is under error 
state, processing does not write but returns to the main part. 

When it is not under error state, the page program command (4116) is written in the flash memory, then 256 
bytes of data is written. After data has been written, the read array command (FF 16) is written and processing 
returns to the main part. 

Figure 4.2.12 shows processing flow. 


Page program 


Receive cycles 
r3=0 
Set low-order address, 
addr_l=0 
~—_ 


Set reception address 


Read the receive buffer 
register 


Store the reception data 


to RAM 
r3=258 


| Read array command 


E 
Status error? ‘ror 


OK 


Write the page program 
command 


Write cycles r3=0 


Figure 4.2.12 Page Program 
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Block Erase 


A specified block area of the flash memory is erased. However, blocks that are locked by Lock Bit Program 
command cannot be erased. To erase these blocks, you need to disable the lock bit. 

After confirming the two bytes of address and one byte of confirm command (D016) received from the serial 
programmer and stored in RAM, write Block Erase command (2016) and confirm command (D016) to the 
area specified by the received address for block erase processing. 

If the received confirm command is incorrect, block erase processing cannot be performed. In this case, 
write Read Array command (FF 16) to the flash memory to return the processing to the main routine. 
Figure 4.2.13 shows a processing flow. 


Block erase 


Receive cycles 
r3=1 


Set low-order address, 
addr_l=OFEh 


Set reception address 


Read the receive buffer 
register 


Store reception data to 
RAM 


r3=13+1 


| 


rm=4 


Confirm the NG 


OK 


Write the block erase 
command 
Write confirm 
command 
- 
Write read array 
command 


Initialize transfer flag 


End 


Figure 4.2.13 Block Erase 
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Erase All Unlock Blocks 


A specified block area of the flash memory is erased. However, blocks that are locked by Lock Bit Program 
command cannot be erased. To erase these blocks, you need to disable the lock bit. 

When the all erase command is received from a serial programmer, receive more 1 byte data in succession. 
After the second data is checked to see if it is confirm command (D016), write Erase All Unlock command 
(2016) and confirm command (D016) to the area specified by the received address for erase all unlock 
blocks processing. 

If the received confirm command is incorrect, erase all unlock blocks processing cannot be performed. In 
this case, write Read Array command (FF 16) to the flash memory to end the processing. 

Figure 4.2.14 shows a processing flow. 


Erase all unlock blocks 


Set read address 


Read the receive 
buffer register 


Confirm the 
confirm command 


OK 
Set dummy address 


Write the erase all 
unlock block command 


Write confirm 
command 


Write read array 
command 


Initialize transfer flag 


i 


End 


Figure 4.2.14 Erase All Unlock Block 
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Read Status Register 


Two bytes of status data indicating the flash memory's operating status is stored to RAM to transmit via 
serial I/O. 

Write the Read Array command (FF 16) to the flash memory, then write the Read Status command (7016). 
After status register reception, write the Read Array command and return to the main routine. 

Figure 4.2.15 shows a processing flow. 


Read status register 


Transfer/receive cycles 
r3=0 


Set dummy address 


Write read array 
command 


Write read status 
register command 


Read SRD 


Write read array 
command 


Clear timer interrupt 
request flag 


Initialize transfer flag 


End 


Figure 4.2.15 Read Status Register 
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Clear Status Register 


Status register error information is cleared. 

The Read Array command (FF16), Clear Status command (5016) and Read Array command (FF 16) are 
written into the flash memory in succession. 

The logic sum for the status register 1 (SRD1) is obtained on 9C16 and the error flag is cleared. Processing 
returns to the main part. 

Figure 4.2.16 shows a processing flow. 


Clear status register 


Set dummy address 


Write read array 
command 


Write clear status 
register command 


Write read array 
command 


Clear SRD1 error flag 


Initialize transfer flag 


End 


Figure 4.2.16 Clear Status Register 
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Read Lock Bit Status 


One byte of data indicating the lock status of each individual block in the flash memory is saved via serial 
I/O. Of the 1-byte data, the 6th bit indicates lock status. When "1", the block is unlocked. When "0", the 
block is locked. 

After receiving two byte of data indicating address, store specified address in the address buffer. At this 
time, set #FE16 to the low order address. 

The Read Array command (FF16) and the Read Lock Bit command (7116) are written and, there after, the 
lock bit information is read from the flash memory. After the lock bit information has been read, the Read 
Array command (FF 16) is written again. Processing then returns to main part. 

Figure 4.2.17 shows a processing flow. 


~— 


Read lock bit status 


Transfer/receive cycles 
r3=1 


Set low-order address, 
addr_l=OFEh 


i 


Set read address 


Read the receive buffer 
register 


Store the reception data 
to address buffer 


r3=r3+1 


13<3 


i 


13=3 


Write the read lock bit 
status command 


Read the read lock 
bit data 


Write the read array 
command 


Set transfer flag 


End 


Figure 4.2.17 Read Lock Bit Status 
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Lock Bit Program 


Blocks in the flash memory is locked. Locked block areas cannot be erased. 

After receiving two byte of data indicating address, store specified address in the address buffer. At this 
time, set #FE16 to the low order address. 

If the Received Confirm command is incorrect, lock bit program processing cannot be performed. If correct, 
for lock bit program processing, write the Lock Bit Program command (7716) to the flash memory and the 
Confirm command (D016) in succession. Write Read Array command (FF 16) and processing returns to the 
main part. 

Figure 4.2.18 shows a processing flow. 


Lock bit program 


Transfer/receive cycles 
r3=1 


Set low-order address, 
addr_l=OFEh 
<a 


Set read address 


Read the receive buffer 
register 


Store reception data to 
address buffer 


r3=4 
Confirm confirm NG 
command 
OK 


Write the lock bit 
program command 


Write the confirm 
command 


Write the read array 
command 


=a 
Initialize transfer flag 


End 


Figure 4.2.18 Lock Bit Program 
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Lock Bit Enable/Disable 


Enables/disables the lock bit function of flash memory. The lock bit disable command cancels the lock on 
all blocks. 

To enable the lock bit, "0" is written for the lock bit cancel bit. To disable the lock bit, "0" followed by "1" is 
written for the lock bit cancel bit. 

Figure 4.2.19 shows a processing flow. 


Lock bit valid Lock bit invalid 
Clear the lock bit Clear the lock bit 
cancel bit cancel bit 
Initialize transfer flag Set the lock bit 


cancel bit to "1" 
Initialize transfer flag 


End 


Figure 4.2.19 Lock Bit Enable/Disable 
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ID Check 


The ID data stored in the flash memory is compared with the data received by serial I/O. This process 
judges whether the flash memory is blank or not. When blank, the ID check is ended and processing 
returns to the main part. When something is written in the ROM, the received ID address, the ID data size 
and ID data contents are checked. When mismatch, ID check error is generated (SR10 = 1, SR11 =0) and 
processing returns to the main part. When match, the ID check is ended (SR10 = 1, SR11 = 1) and 
processing returns to the main part. 

Figure 4.2.20 shows a processing flow. 


ID check 


Blank flag? 


Blank 


Not blank 


Error 


Check address & ID 


OK 
ID check cycles r3=1 


ne 2 


ID check error 


SR11=0, SR10=1 


ID check completed 
SR11=1, SR10=1 


> ~<a 
Initialize transfer flag 


End 


Figure 4.2.20 ID Check 


171 


M16C/80 Group 
4 4.2 Developing The Boot Program 


Version Information Output 


Transfer flag is set to transfer the version information of the boot program via serial I/O. 
Figure 4.2.21 shows a processing flow. 


Version information 
output 


Set transfer flag 


Figure 4.2.21 Version Information Output 


Data Transfer Processing 


The result of process after receiving a control command from serial programer is transfered via serial I/O. 
When transfer flag is 0, or time-out flag is 1, the processing returns to the main part. Otherwise next 
process is executed. Command buffer is read, the serial command is compared, and processing branches 
to the process in the match commands. After processing, initialize the transfer flag and return to main part. 
With mismatch commana, initialize the transfer flag and return to main part. 

Figure 4.2.22 shows a processing flow. 


Data transfer 
Timer initialization 


Is transfer flag set? 


¥ 


FFh | Page read output | 
70h | Read status register output | 
ral [| Read lock bit status output |] 


Y 


Initialize transfer flag 


End 


Figure 4.2.22 Data Transfer 
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Page Read Transfer Processing 


Data from the user area in blocks of 256 bytes is read and the read data is sent via serial I/O. 

Data is read from the flash memory and set to transfer buffer register. The timer used to check data 
reception time-out is started. When data is not received within 300 msec, a time-out error is judged, time- 
out processing flag is set and processing jumps to data transfer processing. After 256 bytes of data is 
received, processing jumps to data transfer processing. 

Figure 4.2.23 shows a processing flow. 


Transfer/receive cycles 
r3=0 


Write to transmit buffer 
register 


Start one-shot timer 


Reception 
completed? 


Set time-out 
processing flag 


y| 


Read the receive buffer 
register 
Address = address + 1 


13=/256 


Figure 4.2.23 Page Read Transfer Processing 
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Read Status Register Transfer Processing 


The two-byte status data (SRD: status register and SRD1: status register 1) that indicates flash memory 
operating status is sent via serial I/O. 

The SRD is read from flash memory and written into transmit buffer register. The timer used to check data 
reception time-out is started. When data is not received within 300 msec, a time-out error is judged, time- 
out processing flag is set and processing jumps to data transfer processing. After data reception is 
completed, receive buffer register is read. 

The SRD1 is read from flash memory and written into transmit buffer register. The timer used to check 
data reception time-out is started. When data is not received within 300 msec, a time-out error is judged, 
time-out processing flag is set and processing jumps to data transfer processing. After data reception is 
completed, reception buffer register is read and processing returns to data transfer processing. 

Figure 4.2.24 shows a processing flow. 


Read status register 
output 


Transfer/receive cycles 
r3=0 


Clear timer interrupt 
request flag 


~ait 


Write to transmit buffer 
register 


Reception 
completed? 


¥ 


Read the receive buffer 
register 


r3=ra+1 


Read SRD1 


13<2 


Figure 4.2.24 Read Status Register Transfer Processing 
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Read Lock Bit Status Transfer Processing 


The lock bit status that set in command processing is sent via serial I/O. 

The lock bit status data that set in command processing is read from RAM and written into transmit buffer 
register. The timer used to check data reception time-out is started. When data is not received within 300 
msec, a time-out error is judged, time-out processing flag is set and processing jumps to data transfer 
processing. After data reception is completed, processing jumps to data transfer processing. 


Figure 4.2.25 shows a processing flow. 
Read lock bit status 
output 


Write to transmit buffer 
register 


Start one-shot timer 
Se _ 


Reception 
completed? 


Jump to time-out 
processing 


Read the receive buffer 


register 


Figure 4.2.25 Read Lock Bit Data Transfer Processing 
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Version Information Output Processing 


The version information of boot program is sent via serial I/O. 

Version information is read and written in the transmit buffer register. 

The timer used to check data reception time-out is started. When data is not received within 300 msec, a 
time-out error is judged, time-out processing flag is set and processing jumps to data transfer processing. 
After all version information is send, processing jumps to data transfer processing. 

Figure 4.2.26 shows a processing flow. 


Version information 
output 


a0=0 


Transfer/receive cycles 
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Set time-out 
processing flag 


Y 
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Figure 4.2.26 Version Information Output Processing 
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Time-Out Processing 


When time-out flag is set, serial I/O and time-out flag are initialized. 
Figure 4.2.27 shows a processing flow. 


Time-out process 


Is serial initialization 
flag set? 


Is time-out 
processing flag set? 


Y 


Time-out flag 
(SRD1)=1 


Ee 


Initialize time-out 
processing flag 


Initialize serial I/O 
initiallization flag 


Initial setting 2 
UART1 setting 


~ 
End 


Figure 4.2.27 Time-Out Processing 


Command Write 


Commands are written in the flash memory. Commands are accepted when the flash memory is in the 
ready state (RY/BY signal status flag [bit 0 in address 03B716 of the flash memory 

control register] is "1"). 

Figure 4.2.28 shows a processing flow. 


Figure 4.2.28 Command Write 
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Status Register (SRD) 


The status register indicates operating status of the flash memory and status such as whether an erase 
operation or a program ended successfully or in error. It can be read by writing the read status register 
command (7016). Also, the status register is cleared by writing the clear status register command (5016). 
Table 4.2.2 shows the definition of each status register bit. After clearing the reset, the status register 
outputs "8016". 


Table 4.2.2 Status Register (SRD) 


Each bit of Definition 
Status name 


Write state machine (WSM) status Ready Busy 


Reserved : : 


Erase status Terminated in error | Terminated normally 


Program status Terminated in error | Terminated normally 


Block status after program Terminated in error | Terminated normally 


Reserved 


Reserved 


Reserved 


Write State Machine (WSM) Status (SR7) 
The write state machine (WSM) status indicates the operating status of the flash memory. When power is 
turned on, "1" (ready) is set for it. The bit is set to "O" (busy) during an auto write or auto erase operation, 
but it is set back to "1" when the operation ends. 


Erase Status (SR5) 
The erase status reports the operating status of the auto erase operation. If an erase error occurs, it is set 
to "1". When the erase status is cleared, it is set to "0". 


Program Status (SR4) 
The program status reports the operating status of the auto write operation. If a write error occurs, it is set 
to "1". When the program status is cleared, it is set to "0". 


Block Status After Program (SR3) 

If excessive data is written (phenomenon whereby the memory cell becomes depressed which results in 
data not being read correctly), "1" is set for the block status after-program at the end of the page write 
operation. In other words, when writing ends successfully, "8016" is output; when writing fails, "9016" is 
output; and when excessive data is written, "8816" is output. 

If "1" is written for any of the SR5, SR4 or SR3 bits, the Page Program, Block Erase, Erase All Unlocked 
Blocks and Lock Bit Program commands are not accepted. Before executing these commands, execute 
the Clear Status Register command (5016) and clear the status register. 
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Status Register 1 (SRD1) 


Status register 1 indicates the status of serial communications, results from ID checks and results from 
check sum comparisons. It can be read after the SRD by writing the Read Status Register command 


(7016). 


Also, status register 1 is cleared by writing the Clear Status Register command (5016). 
Table 4.2.3 gives the definition of each status register 1 bit. "0016" is output when power is turned ON and 
the flag status is maintained even after the reset. 


Table 4.2.3 Status Register 1 (SRD1) 


Each bit of 
SRD1 


SR15 (bit7 


Status name 


Boot update completed bit 


Definition 


Update completed 


Not update 


SR14 (bit6 


Reserved 


SR13 (bit5 


Reserved 


Checksum match bit 


Match 


Mismatch 


SR11 (bit3 
SR10 (bit2 


(bit7) 
(bit6) 
(bitS) 
SR12 (bit4) 
(bit3) 
(bit2) 


ID check completed bits 


00 Not verified 


01 Verification mismatch 


10 Reserved 
11 Verified 


SR9 (bit1) 


Data receive time out 


Time out | Normal operation 


SR8 (bitO) 


Boot Update Completed Bit (SR15) 


Reserved 


This flag indicates whether the control program was downloaded to the RAM or not, using the download 


function. 


Checksum Match Bit (SR12) 
This flag indicates whether the check sum matches or not when a program, is downloaded for execution 


using the download function. 


ID Check Completed Bits (SR11 and SR10) 
These flags indicate the result of ID checks. Some commands cannot be accepted without an ID check. 


Data Reception Time Out (SR9Q) 
This flag indicates when a time out error is generated during data reception. If this flag is attached during 
data reception, the received data is discarded and the microcomputer returns to the command wait state. 
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4.3 Sample List 


This section shows a sample list of the program described in Section 4.2. 

In addition to the processing explained in Section 4.2, the sample shown below includes the programmer 
command processing used by a synchronous serial programmer and the command processing used by an 
asynchronous serial communication programmer (M16C Flash Start). 


Source 


PRR RRR KR RK KR KKK KK KKK KKK KKK KK KKK KKK KEK KEK KKK KEK KE KK KEK KEK KK 


7* System Name : Sample Program for M16C/80 Flash 

:= MCU : M30800FCFP bt 
Peel Xin : 2M-20MHz (for UART mode ) x 
pee Assembler : AS308 ver 1.00.00 *, 
;* Linker : LN308 ver 1.00.00 im 
ee Converter : LMC308 ver 1.00.01 iat 
ne * 
ee Copyright,1999 MITSUBISHI ELECTRIC CORPORATION * 
* * 


AND MITSUBISHI SEMICONDUCTOR SYSTEM CORPORATION 
ZTFFFFFTTLAFEFETTLFFFFETELFFFETTEEFFFETTEFEFETEP EFF E TPE +++ 


~ 


Ha Include file + 
Fi sa i i 
-list off 
- include sfr800.inc 
- include flash800.inc 
7 LES on 


r 

PEFEEEEEEAALE FEF E FEE EE EFF EEFEPFEAFEE AFH EEE HHP EEE HE HHH 
yt Version table + 
PEFEEEEFEFALEFAEE FEE EE FEF E EEE EE AFH EEE PHP +++ +H HF 


, 


.-section rom, code 
.org Offe000h 
.byte "VER.0.00(VER.1.00)' 


a 


ZTFLAFHTTTEFFFETTLFFEFETTLFFFETTLEFFFETTEFFFETE TEEPE E+ ++ 44+ 


it Program section start + 
PEEEEEEEEAEEEE EFF FEFEEEEEE EFF FEFEEEPEEEEEFFEEEEPEEEEEE PEP ET 
-section prog, code 
.org Boot_TOP 
.sb SB_base 
.sbsym SRD 
.sbsym SRD1 
.sbsym ver 
.sbsym SF 
.sbsym addr_1l 
.sbsym addr_m 
.sbsym addr_h 
, 
, 
po Boot program start + 
, 
Reset: 
, 
7+ TInitialize_1 af 
, 
ldc #Istack, ISP ; stack pointer set 
Lae #SB_base, SB , SB register set 
, 
bset busy 
bset busy_d , BUSY "H"output 
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belr s_mode_d ; Serial mode select input 
i 
r 
jt Hot start & RAM clear + 
, 
r 
mov.w 0,a0 
Start_check: 
cmp .w 55aah, buff [a0] 
jne RAM clear 
add.w 2,a0 
cmp .w 18,a0 
jltu Start_check 
bset ram_check ; RAM check OK flag set 
jmp CPU_set 
r 
RAM_clear: 
mov.w 0,xr0 
mov.W (Ram_END+1-Ram_TOP) /2,r3 
mov.w Ram_TOP, al 
sstr.w 
r 
mov.w 0,a0 
Buff_set: 
mov.w 55aah, buff [a0] 
add.w 2,a0 
cmp .w 18,a0 
jltu Buff_set 
, 
r 
7+ Processor mode register + 


jt & Syst 


em clock control register + 


t 
CPU_set: 
mov. 
mov. 
mov. 
mov. 
mov. 
mov. 


TOO 7O Fo 


’ 


Reload_chack 


#3,prcer ; Protect off 
#0000h, pm0O ; wait off 
#04h,mcd ; £4 

#20h, cm1 

#08h, cmO : 

#0,prer ; Protect on 


btst srl15 ; Update ? 
ne Transfer_end 
btst ram_check ; Reload ? 
jz Version_inf ; 
btst s_mode 
bxor old_mode 
jne Transfer_end 
F 
r 
jt Version information + 
r 
Version_inf: 
mov.w #0,a0 ; ad=0 
Ver_loop: 
mov.w Offe000h+9[a0],ver[a0] ; Version data store 
add.w #2,a0 ; address increment 
cmp .w #8,a0 ; a0=8 ? 
jltu Ver_loop 7 jump Ver_loop at a0<8 
£E 
r 
pt Program_transfer + 
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btst 
jz 

, 

Transferl: 
bset 
mov.1 
mov.W 
mov.W 
smovf.w 

jmp 

, 

Transfer2: 
bclr 
mov.1 
mov.W 
mov.W 
smovf.w 


s_mode 
Transfer2 


old_mode 
#Trans_TOP1,a0 


, 


, 


#Ram_progTOP,al ; 
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Serial I/O mode select 
UART mode 


clock synchronous mode 
Transfer source address 
Transfer destination address 


#(Trans_END1 - Trans_TOP1)/2,r3 ; Transfer number 


Transfer_end 


old_mode 
#Trans_TOP2 ,a0 
#Ram_progTOP,al 


, 


, 
a 


, 


String move 


UART mode 
Transfer source address 
Transfer destination address 


#(Trans_END2 —- 


Transfer_end: 


, 


Trans_TOP2)/2,r3 ; Transfer number 


String move 


, 


aoa Jump to RAM + 
, 
jmp Ram_progTOP 
, 
pt Download program + 
, 
.org Download_program 
, 
jsr set_TAO 
mov.w #0,xr3 ; receive number (r3=0) 
mov.w #0,al ; sumcheck buffer 
belr srl5 ; Download flag reset 
be lr srl2 ; Check sum flag reset 
Download_loop: 
jsr SIO_D_rcv 
btst tout_flg ; time out error ? 
1¢ Download_err 7 jump Download_err at time out 
mov.w rcev_d,r0 ; veceive data read --> r0 
add.w #1,xr3 
cmp .w #3,xr3 3 r3=3 ? 
jgtu Version_store 7 jump Version_store at r3>3 
mov.w r3,a0 * 23 ==> ad 
mov.b r01,addr_1 [a0] ; Store program size 
mov.w #0,a0 ; aO initialize 
cmp .w #3,xr3 3; r3 =3? 
jne Download_loop ; No, jump to Download_loop 
cmp .w #0,addr_m ; program size = 0 ? 
yz Version_inf 7 jump to Version_inf at program size error 
jmp Download_loop 7 jump Download_loop 
Version_store: 
cmp .w #11,4r3 ; v3=11 ? 
jgtu Program_store 7 jump Program_store at r3 >11 
mov.b r0l1,ver[a0] ; version data store to RAM 
jmp Program_store_1 


, 


Program_store: 
r01,Ram_progTOP-8 [a0] 7 program data store to RAM 
Program_store_1: 


mov.b 


add.b 
add.w 
cmp .w 
jltu 
jmp 


r0Ol,al 

#1,a0 
addr_m, a0 
Download_loop 
SUM_Check 


, 


, 


add data to al 

a0 (downloaO offset) +1 increment 

a0 = program size (addr_m,h)? 

jump Download_loop at a0< program size 
jump SUM Check 
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bset busy 7 busy "H" 
bset busy_d 7 busy output 
mov.b #0,ulcl ; transmit/receive disable 
mov.b #0,ulmr ; ulmr reset 
jmp Version_inf 
, 
; 
ot Download program -— UART mode - + 
; 
.org U_Download_program 
; 
mov.w #0,4r3 ; receive number (r3=0) 
mov.w #0,al ; sumcheck buffer 
belr srl5 7 Download flag reset 
belr srl2 ; Check sum flag reset 
U_Download_loop: 
jsr U_SIO_D_rcv 
mov.w revod, 70 
add.w #1,xr3 ; v3 +1 increment 
cmp .w #3,xr3 ; r3=3 ? 
jgtu U_Version_store ; jump U_Version_store at r3>3 
mov.w r3,a0 , ¥3 =—> al 
mov.b r01l,addr_1[a0] ; Store program size 
mov.w #0, a0 ; aO initialize 
cmp .w #3,4r3 7; r3 =3? 
jne U_Download_loop ; No, jump U_Download_loop 
cmp .w #0,addr_m ; program size = 0 ? 
jz Version_inf 7 jump Version_inf at program size error 
jmp U_Download_loop 
U_Version_store: 
cmp .w #11,r3 eC3=11 “2 
jgtu U_Program_store ; jump U_Program_store at r3 >11 
mov.b r0l,ver[a0] ; version data store to RAM 
jmp U_Program_store_1l 


’ 


U_Program_store: 
r01,Ram_progTOP-8 [a0] ; program data store to RAM 
U_Program_store_1: 


mov.b 


add.b 
add.w 
cmp .w 
jltu 
; 
SUM_Check: 
mov.w 
cmp .b 
bmeq 
jne 
bset 
jmp 


’ 


rOl,al 

#1,a0 

addr_m, a0 
U_Download_loop 


al,r0O 

data, r0Ol 
sr12 
Version_inf 
sr15 
Ram_progTOP 


’ 


add data to al 

a0 (downloaO offset) +1 increment 

a0 = program size (addr_m,h)? 

7 jump Download_loop at a0< program size 


compare check sum 

check sum flag set at data=r0l 

jump Version_inf at check sum error 
Download flag set 

jump Ram_progTOP 


FEET TTTEFFFET TL EFEFETTLEFFFTTLEFFFFTTTEFFFETTEEFEF ETP +444 


t+ Subroutine 


a synchronized signal I/O receive dwn+ 


FEEFFFTT LEFT F LEFF EFETTLEFFFT ELLE FFFTELEFFFETEPEFEE EE ++ 444+ 


STO_D_rcv: 
mov.b 
bset 


btst 
bmc 
jc 
btst 


rll,ultb 
ta0os 


ir_taOic 

srg 
SIO_D_rcv_err 
TE OE 


; tad start 


; time out error ? 

; time out flag set 
7 jump SIO_D_rcev_err 
; receive complete ? 
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jnce ?- 

mov.w ulrb, rcv_d ; veceive data read --> r0 
STIO_D_rcv_end: 

Les 


SIO_D_rcev_err: 
bset tout_flg 
jmp SIO_D_rcv_end 


Fr iss a ns OL 
p+ Subroutine : UART receive dwn + 
Fr iss ins 
U SiO Dp rev: 


btst ei eT 7 receive complete ? 

jne U_SIO_D_rcv 

mov.w ulrb, rcv_d ; veceive data read --> r0 

rts 
, 
, 
;+ Transfer Program -- clock synchronous serial I/O mode + 
e+ (1) Main flow + 
pik (2) Flash control program + 
3+ Read, Program, Erase, All_erase,etc. + 
it (3) Other program + 
p+ ID_check, Download, Version_output etc. + 
, 

-section dump, code 

.org Trans_TOP1 
Fr iss a ia 
it Main flow - clock synchronous serial I/O mode - + 


PEELE FELEAE EEL EEE FEFEEEEELE EE EEF EEEEEEEE EE FEF FEE EAEE FEE HEH H 
Main: 
jsr Initialize _2 ; clock synchronous serial I/O mode 
mov.b #0,data 
Loop_main: 
mov.b SRD1,SRD1_bak ; SRD1 back up 
mov.b SRD1, SRD1_bak+2 


jsr time_init 
jsr SIO_rcv_first_data 
jsr Flash_func 
jsr SIO_send_data 
jsr Time_out 
jmp Loop_main 
v 
, 
p+ initialize SIO + 


, 
time_init: 


beclr tout_flg 
belr tint_flg 
bset ta0os 


mov.b #0,ta0ic 
Loop_mainl: 


btst ir_taOic ; 300 usec ? 
jz Loop_mainl 
bset rev_flg 
ets 
v 
, 
jt SI/O time out + 
, 
Time_out: 
btst tint_flg 
jc Time_out_init 
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btst tout_flg 
jne Time_out_end 
bset srg ; SRD1 time out flag set 
belr tout_flg 
Time_out_init: 
belr tint_flg 
jsr Initialize _21 ; command error,UART1 reset 
Time_out_end: 
ris 
, 
r 
7+ SI/O recieve data + 


’ 


SIO_rcv_first_data: 


mov.b #0,cmd_d 
belr cmd_flg 
btst rcev_flg 

jne STO_rcv_end 
btst tout_flg 

jc SIO_rcv_end 
mov.b #0,ta0ic 
mov.w #0,1r2 
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SIO_rcv_first_data_loop: 
mov.b #0ffh,r11 ; #f£fh --> rll (transfer data) 
mov.b rll,ultb 
btst cmd_flg 
jc SIO_rcv_first_data_loopl 
belr busy_d 7 busy input 
Re <brSt busy ; Reception start? 
jz oS 
SIO_rcv_first_data_loop1: 
bset ta0os ; 300 usec timer start 
r 
SIO_rcv_first_data_loop2: 
btst Ly tavic ; 300 usec ? 
jne P+ 
bset tout_flg ; time out 
?: btst tout_flg 
jc SIO_rcv_end 
btst ri_ulcl 7 receive complete ? 
jz SIO_rcv_first_data_loop2 
mov.w ulrb, r0 ; receive data --> r0 
mov.w r2,a0 
mov.b r01,data[a0] 
add.w #1,r2 
r 
btst cmd_flg 
jc SIO_loop_chk 
bset cmd_flg 
mov.b r01,cmd_d 
r 
mov.w #15,a0 
SIO_rcv_command_chk: 
mov.b Index_tb1l-Trans_TOP1+Ram_progTOP-1[a0],rOh 
cmp.b rOh, r0l 
jeq STO_cmd_jmp_2 
sbjnz.w #1,a0,SIO_rcv_command_chk 
jmp SIO_rcv_end_1 


’ 


SITO_cmd_jmp_2: 


shl.w 
mov.w 


#1,a0 
jmp_tb1_2-Trans_TOP1+Ram_progTOP-2[a0],r0 


STO_cmd_jmp_2_1: 


jmpi.w 


ro 
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, 


SIO_2: 
mov.w 2, loop_cnt 
jmp SIO_loop_chk 
SIO_259: 
mov.w 259, loop_cnt 
jmp SIO_loop_chk 
SIO_4: 
mov.w 4, loop_cnt 
jmp SIO_loop_chk 
SIO_3: 
mov.w 3, loop_cnt 
jmp SIO_loop_chk 
r 
, 
yt ID check SI/O + 


, 


STO_rcv_ID_check: 


mov.w #0,xr3 7 receive number (r3=0) 
mov.w #0ffh,al ; ID size (dummy data = ffh) 
mov.b #0,ta0ic 
SIO_ID_data_store: 
cmp .w al,xr3 ; v3=al(ID size) 
jeq SIO_ID_address_check; jump ID_address_check at r3=ID size 
mov.b rldyulLtebp ; data transfer 
bset ta0os ; tad start 
SIO_ID_data_loop: 
btst ir_taOic ; 300 usec ? 
jne P+ 
bset tout_flg ; time out 
?: btst tout_flg 
1¢ SIO_ID_address_check 
btst Fp lel 7 receive complete ? 
jne SIO_ID_data_loop 
mov.w ulrb, r0 ; veceive data read --> r0 
mov.w r3,a0 - ro --> al 
mov.b r01,addr_1 [a0] ; Store address 
add.w #1,xr3 ; v3 +1 increment 
cmp .w #4,4r3 ; v3=4 ? 
jne SIO_ID_data_store 7 jump ID_data_store at r3 not= 4 
mov.b data,al ; ID size --> al 
add.w #4,al ; al=al+4 
jmp SIO_ID_data_store 7 jump ID_data_store 
SIO_ID_address_check: 
jmp SIO_rcv_end 


, 

STO_rcv_end_1: 
bset tint_flg 
jmp SIO_rcv_end 


SIO_loop_chk: 
cmp .w loop_cnt, r2 
jltu SIO_rcv_first_data_loop 


STO_rcv_end: 


belr cmd_flg 
belr rev_flg 
rts 
, 
, 
yt STO_send data + 


, 
SIO_send_data: 
jsr set_TAO 
btst send_flg 
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’ 


STO_send_data_end 
tout_flg 

STO_send_data_end 
cmd_d,rlh 


#0ffh,rih 
Read_data 
070h,rih 
Read_SRD_data 
O71h,rlh 
Read_LB_ data 
Ofbh,rih 
Ver_output_data 
#0fdh,rih 
Read_check_data 
#0fch,rih 
Boot_data 

SIO_send_func 


Read_check_data: 


mov.w #0,4r3 

mov.w sum, rl 
Read_check_data_loop: 

mov.b rll,ultb 

bset ta0os 
Read_check_data_check: 

btst ir_taQOic 

jne P+ 

bset tout_flg 
os 

btst tout_flg 

ake SIO_send_data_end 

btst ri_ulcl 

jnce Read_check_data_check 

mov.w ulrb, r0 

mov.b rlh,ril 

add.w #1,4r3 

cmp .w #2,4r3 

jltu Read_check_data_loop 
Read_check_data_end: 

mov.w #0,sum 

jmp STO_send_data_end 
r 
Read_data: 

mov.Ww #0,4r3 
Read_data_loop: 

mov.b [al],r1l 

mov.b rll,ultb 

bset ta0os 
Read_data_chk: 

btst ir_taOic 

jne P+ 

bset tout_flg 
eas 

btst tout_flg 

jc Read_data_end 

btst ri_ulcl 

jne Read_data_chk 

mov.w ulrb, r0 

add.w 1,3 

add.1 1,al 

cmp .w 256,83 

jne Read_data_loop 


Read_data_end: 


’ 


’ 


’ 


’ 


Read (ffh) 


Read SRD (70h) 


Read LB (71h) 


Version_output (fbh) 


Read_check (fdh) 


Boot_check (fch) 


ta0O start 


receive complete ? 


receive data read --> r0 


reset 


Flash memory read 


’ 


ta0 start 
300 usec ? 


time out 


receive complete ? 


receive data read --> r0 
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jmp STO_send_data_end 
, 


Ver_output_data: 


mov .w #0,a0 ; 
Ver_output_data_loop: 

mov.b ver[a0],ultb ; 

bset tados ; 
Ver_output_data_check: 

btst ir_taOic : 

jne P+ 

bset tout_flg ; 
Bs 

btst tout_flg 

jc Ver_output_data_end 

btst ri_ulcl ; 

jne Ver_output_data_check 

mov.w ulrb, r0 : 

add.w #1,a0 

cmp .w #8, a0 s 

jne Ver_output_data_loop 


Ver_output_data_end: 
jmp STO_send_data_end 
, 


Read_SRD_data: 


mov.w #0,4r3 
Read_SRD_data_loop: 

bolls tout_flg . 

mov.b #0,ta0ic : 

mov.b eT ULE ; 

bset tados ; 
Read_SRD_data_check: 

btst ir_taOic ; 

jne P+ 

bset tout_flg ; 
ae DESE tout_flg 

jc Read_SRD_data_end 

btst ra-uleL : 

jne Read_SRD_data_check 

mov.w ulrb, r0 : 

mov.b SRD1,r11 H 

add.w 1,r3 

cmp .w 27°E3 : 

jltu Read_SRD_data_loop ; 


Read_SRD_data_end: 

jmp SIO_send_data_end 
, 
Read_LB_ data: 
Read_LB_ data_loop: 


mov.b 11, uitb : 

bset ta0os : 
Read_LB_ data_check: 

btst ir_taOic : 

jne P+ 

bset tout_flg ; 
oes 

btst tout_flg 

uke: Read_LB_data_end 

btst ri_ulcl ; 

jne Read_LB_data_check 

mov.w ulrb, r0 ; 


Read_LB_data_end: 


jmp SIO_send_data_end 
r, 
Boot_data: 

belr fmr05 


Version address offset 
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(a0=0) 


send_data set 


ta0O start 


300 usec ? 


time out 


receive complete ? 


receive data read --> r0 


clear time out 
clear time out 
data transfer 


ta0O start ; test 
300 usec ? 

time out 

receive complete ? 


receive data read --> r0 
SRD1 data --> rll 


r3 =2 ? 
jump Read_SRD_loop at r3<2 


data transfer 
ta0O start 


300 usec ? 


time out 


receive complete ? 


receive data read --> r0 
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mov.w addr_1,a0 
mov.b addr_h,al 
mov.w #0,4r3 
sha.l #16,al 
add.1 a0,al 
Boot_data_loop: 
mov.b [al],r1l ; Boot data read 
mov.b rll,ultb 
bset tados ; tad start 
Boot_data_chk: 
btst ir_taQ0ic ; 300 usec ? 
jnc P+ 
bset tout_flg ; time out 
Ory 
btst tout_flg 
jc Boot_data_end 
btst ri_ulcl 7 receive complete ? 
jne Boot_data_chk 
mov.w ulrb; 70 ; receive data read --> r0 
add.w #1,xr3 
add.1 #1,al 
cmp .w #256,4r3 7; v3 = 256 ? 
jne Boot_data_loop 
Boot_data_end: 
bset fmr05 
jmp STO_send_data_end 


’ 


STO_send_func: 


mov 


-W 


start_cnt,r3 


SIO_send_data_loop: 


mov 
mov 
mov 
bse 


.W 
-b 
-b 


r3,a0 

data[a0],r1l 
r1l,ultb ; 
tados ; 


SIO_send_chk: 


bts 
jne 
bse 
?: bts 
jc 
bts 
jne 
mov 
add 
cmp 
jne 
mov 


~W 
-W 
~W 


-W 


ir_ta0ic ; 
?+ 

tout_flg ; 
tout_flg 
STO_send_data_end 
ri_ulcl 
SIO_send_chk 

ulrb, r0 . 
#1,4r3 

send_cnt,r3 : 
STO_send_data_loop 
r3,r0 


SIO_send_data_end: 


bel 
2ES 


’ 


r. 


send_flg 


data transfer 
ta0O start 


300 usec ? 


time out 


receive complete ? 


receive data read --> r0 


r3 = send_cnt ? 


FEET TT FLEET T TL EFEFETELEFFFETTLEFFFTETEFFFETTPEF EP EE + +444 


it 


rts 


Subroutine : Time_over_flg 
Fro sss ns Ln RL 
Time_over_flg: 

bset 


tout_flg 


FLEFFFFTLEFEFTTTEFFFFTTTLEFFFETLLEFFFTELEFFFETTEEEEP EE T+ +++ 


table for Flash_func 


+ 


FEET T TL EFFAFET TE FFFFTTLEEFFFE ELLE FFFTELEEFFETTEEFEF EE +++ 4+ 


it jump 

jmp_tbl: 
.word 
.word 
.word 


Read —- cmd_jmp 
Program -— cmd_jmp 
Erase — cmd_jmp 
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-word All_erase - cmd_jmp 
-word Clear_SRD - cmd_jmp 


.word Read_LB - cmd_jmp 
.word Program_LB - cmd_jmp 
-word LB_enable - cmd_jmp 
-word LB_disable - cmd_jmp 
-word Download - cmd_jmp 
.word Boot_output - cmd_jmp 
.word Read_check - cmd_jmp 


ZTFLFFFTTTEFEFETTLFFEFE TELE FFE TEE EFFFTT TEEPE TEEEFEP EET + +44 


pat jump table for SIO_rcv_first_data + 
Fos is is is SL 
jmp_tbl_2: 

.word SIO_3 - SIO_cmd_jmp_2_1 ; Read 

.word SIO_259 -— SIO_cmd_jmp_2_1 ; Program 

.word SIO_4 - SIO_cmd_jmp_2_1 7 erase 

.word SIO_2 - SIO_cmd_jmp_2_1 ; All erase 

.word SIO_rcv_end - SIO_cmd_jmp_2_1 ; Clear SRD 

.word SIO_3 - SIO_cmd_jmp_2_1 ; Read LB 

.word SIO_4 - SIO_cmd_jmp_2_1 ; LB Program 


.word SIO_rcv_end - SIO_cmd_jmp_2_1 ; LB enable 
.word SIO_rcv_end - SIO_cmd_jmp_2_1 ; LB disable 
.word SIO_rcv_end - SIO_cmd_jmp_2_1 ; Download 
.word SIO_3 - SIO_cmd_jmp_2_1 , Boot output 
.word SIO_rcv_end - SIO_cmd_jmp_2_1 ; Read check 
.word SIO_rcv_end - SIO_cmd_jmp_2_1 ; Read SRD 
-word STO_rcv_ID_check - SIO_cmd_jmp_2_1 ; ID check 
.word SIO_rcv_end - SIO_cmd_jmp_2_1 ; Version out 


, 


ZTHLEFFTHTLEFEFETTLFFEFETTLFFFE TE EEFFFTTTEFEFETE PEEP E E+ +444 


Had serch table for Flash_func,SIO_rcv_first_data + 
PEAEEEEEEFELEEEHEEEEEEEEEAEE FFE E EEE EE FAFA HEE EPP EAA E EHH HEF 
Index_tbl: 

-byte Offh ; Read(ffh) 

-byte 041h ; Program (41h) 

-byte 020h ; Erase (20h) 

-byte Oa7h ; All_erase(a7h) 

.-byte 050h ; Clear SRD (50h) 

-byte O71h ; Read LBS (71h) 

-byte O077h ; LB program(77h) 

-byte O7ah ; LB enable (7ah) 

-byte 075h ; LB disable(75h) 

-byte Ofah ; Download (fah) 

-byte Ofch ; Boot output (fch) 

-byte Ofdh ; Read check (fdh) 

-byte 070h ; Read SRD (70h) 

-byte Of5h ; ID check (£5h) 

-byte Ofbh ; Version output (fbh) 


Fr iss cn OL LL 
p+ Subroutine : Initialize _2 + 
Fr iss a IR OL 
Initialize_2: 


a 


yt Flash mode set + 


, 


Flash_mode: 


bset fmr05 ; User ROM select 

bey fmr01 ; Flash entry bit clear 

bset fmr01 ; Flash entry bit set (E/W mode) 
r 
, 
a+ Blank check + 
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mov.w Offfffch, r0 ; Reset vector read 
mov.w Offfffeh,rl ; Reset vector read 
and.w r1,xr0 > 0 & £1 
cmp .w #O0ffffh, r0 ; vO=ffffh ? 
jne blank_end 
, 
bset srl10 ; check complete at rO=ffffh 
bset srll 
bset blank 7 blank flag set 
blank_end: 
, 
; 
it UART1 + 
; 
Initialize 21: 
; 
belr pd6_2 ; RxD-input 
i 
Pie pesler erioe Function select register AO 
; 
mov.b #10010000b, ps0 
; 
ieee oat Function select register BO 
, 
mov.b #00000000b,ps10 
; 
,eSSs= UART1 transmit/receive mode register 
; 
mov.b #0,ulcl ; transmit/receive disable 
mov.b #0,ulmr ; ulmr reset 
mov.b #00001001b, ulmr 
; || | | | +++------- clock synchronous SI/O 
; Il] | |+ external clock 
: +4+4+4+ fixed 
; 
PseHcs UART1 transmit/receive control register 0 
; 
mov.b #00000100b, ulcO 
; I] || [++ fl select 
; || | | +-------- RTS select 
; | | |+---------- CTS/RTS enabled 
; | |+----------- CMOS output (TxD) 
; |+ SSeS falling edge select 
: HSH HSS -SSS=— LSB first 
; 
one UART transmit/receive control register 2 


mov.b #00000000b, ucon 


; I] ||| j++ alee alam Transmit buffer empty 
; || | J++ SSeS Continuous receive mode disabled 
; | | ++---------- CLK/CLKS normal 
i | +------------ CTS/RTS shared 
; PesssessssSss5 fixed 
r 
ona UART1 transmit/receive control register 1 
r 
mov.b #00000101b, ulcl 
7 I ||| | fa SSo-= Transmission enabled 
; I | || ; con anen ania aco Reception enabled 
; +++++4+--------- fixed 
; 
; 
r 
i+ Timer AO + 
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set_TAO 
ere Timer AO mode register 
r 
mov.b #00000010b,ta0Omr 
; || || |++------- One-shot mode 
; I} || + Pulse not output 
; || |+ One-shot start flag 
; | |+ fixed 
; ++ f1 select 
, 
mov.b #0,ta0ic ; clear TAO interrupt flag 
mov.w #6000-1,ta0 ; set 300 usec at 20 MHz 
bset ta0s 
, 
rts 
v 
, 
yt FLASH function main + 
r 
Flash_func: 
btst tout_flg 
je Flash_func_end 
bclr ta0s 
mov.b cmd_d, r01 ; veceive data > £01 
v 
mov.b #0ch, r0Oh ; #00001100b srl10,11 mask data 
and.b SRD1,r0h , srl10,11 pick up 
cmp.b #0ch, r0h ; ID check OK? 
jne Command_check_2 7 jump Command_check_2 at ID unchecked 
mov.w #12,a0 


, 


Command_check: 


mov.b 
cmp.b 
jeq 
sbjnz.w 
jmp 


cmd_jmp_1: 
shl.w 
mov .w 

cmd_jmp: 
jmpi.w 


, 


Index_tb1-Trans_TOP1+Ram_progTOP-1[a0],r0h 
rOh, r0l 
cmd_jmp_1 
#1,a0,Command_check 
Command_check_2 


#1,a0 
jmp_tbl1-Trans_TOP1+Ram_progTOP-2[a0],r0 


ro 


Command_check_2: 


?: cmp.b 
jne 
jmp 

?: cmp.b 
jne 
jmp 

?: cmp.b 
jne 
jmp 


, 


070h, r0l ; Read SRD (70h) 
P+ 
Read_SRD 

Of5h, r01 ; ID check (£5h) 
?+ 
ID_check 

Ofbh, r01 ; Version out (fbh) 
Flash_func_end 

Ver_output 


Flash_func_end: 


©ls 
v 
r 
yt Read + 
, 
Read: 
mov.w #0,xr3 ; receive number 
mov.b #0,addr_1 ; addr_l = 0 
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Read_loo 
add. 
mov. 
mov. 
mov. 
cmp. 
jltu 
mov. 
jsr 
bset 
mov. 
mov. 
jmp 


p: 


WwW 


WwW 
WwW 


#1,4r3 

r3,a0 
data[a0],r0 
r01l,addr_1[a0] 
#2,4r3 
Read_loop 
#00ffh, r2 
Command_write 
send_flg 

#3, start_cnt 
#258, send_cnt 


Flash_func_end 
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, r3 +1 increment 
e193 —--> ad 


; Store address 

ee SS SD: 

7 Jump Read_loop at r3<2 
; Read array command 

7 command_write 


7; jump Flash_func_end 


FLEFFFTTLEFFFTTTLFFFFETTEEFFFETTLEFFFTTTEFFFETEPEFEP EE ++ +44 


it 


Subroutine 


Command write + 


Fits Sis Sis ois isis ie in oi on i i i 
Command_write: 


btst fmr00 ; RY/BY status check 
jz Command_write 
mov.w addr_1,a0 ; addr_1l,m --> a0 
mov.b addr_h,al ; addr_h -—> al 
sha.l #16,al 
add.1 a0,al 
mov.w r2, [al] command write 
rts 
£ 
r 
7+ Program + 
r 
Program: 
mov.w #0,4r3 ; receive number 
mov.b #0,addr_1 ; addr_l = 0 
mov.w sum, cred ; for Read check command 


Program_loop_1: 


add. 


mov. 
jsr 
mov. 


W 


WwW 


#1,4r3 

r3,a0 
data[a0],r0l 
r01l,addr_1[a0] 
#259,4r3 
Program_loop_1 


#00ffh, r2 
Command_write 
#0070h, r2 
Command_write 
[al],r1 
#00ffh, r2 
Command_write 
#80h,r11 
Program_end 


#0041h, r2 
Command_write 
#0,4r3 


Program_loop_2: 


mov 
sha. 
mov. 
mov. 
mov. 
add. 
mov. 


-b 


Zrezeeaer 


addr_h,al 
#16,al 
r3,a0 
data[a0],rl 
addr_1,a0 
a0,al 

r1, [al] 


; v3 +1 increment 
gS Sad 


; Store address 
PES) S259: 2 
7 jump Program_loop_1 at r3<258 


; Read array command 
; command_write 

; Read SRD command 

; Command_write 

; SRD read 

; Read array command 
; command_write 

; error check 


; Page program command 
; command_write 
; writing number (r3=0) 


7 addr_h --> al 
7; x3 --> a0 
; data --> rl 


; addr_l,m --> a0 


; data write 
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mov. 
mov. 


add. 
add. 
cmp. 
jltu 


rll,crcin 
rlh,crcin 


#2,addr_1 
#2,403 
#255,4r3 


Program_loop_2 


Program_end: 
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for Read check command 
for Read check command 


address +2 increment 

writing number +2 increment 
r3 = 255 ? 

jump Program_loop_2 at r3<255 


mov.w ercd, sum 
belr send_flg 
mov.w #0, send_cnt 
mov.w #0, start_cnt 
jmp Flash_func_end 7 jump Flash_func_end 
v 
, 
yt Block erase + 
, 
Erase: 
mov.w #1,4r3 receive number (r3=1) 
mov.b #0feh, addr_1 addr_l = feh 
Erase_loop: 
mov.w r3,a0 r3 53> a0 
mov.b data[a0],r0l 
mov.b r01,addr_1 [a0] Store address 
add.w 1,r3 r3 +1 increment 
cmp .w 4,3 r3=4 ? 
jltu Erase_loop jump Erase_loop at r3<4 
cmp.b Od0h, data Confirm command check 
jne Erase_end jump Erase_end at Confirm command error 
mov.w 0020h, r2 Erase command 
jsr Command_write command write 
mov.w 00d0h, r2 Confirm command 
mov.w r2, [al] command write 
Erase_end: 
mov.W OOffh, r2 Read array command 
jsr Command_write command_write 
belr send_flg 
mov.w 0, send_cnt 
mov.w 0, start_cent 
jmp Flash_func_end jump Flash_func_end 
v 
, 
yt All erase ( unlock block ) + 
, 
All_erase: 
mov.w 1,a0 
mov.b data[a0],r0l receive data read --> r0 
cmp.b Od0h, r0l Confirm command check 
jne All_erase_end jump All_erase_end at Confirm command error 
mov.w 0000h, addr_1 Ofe0000h --> addr 
mov.b O0O0feh, addr_h 
mov.w O00a7h, r2 All erase command 
jsr Command_write command write 
mov.w 00d0h, r2 Confirm command 
mov.w r2, [al] command write 
All_erase_end: 
mov.W OOffh, r2 Read array command 
jsr Command_write command_write 
belr send_flg 
mov.w 0, send_cnt 
mov.w 0, start_cent 
jmp Flash_func_end 7 jump Flash_func_end 


194 


M16C/80 Group 
4.3 Sample List 


pt Read SRD + 
; 
Read_SRD: 

mov.w #0,4r3 receive number (r3=0) 

mov.w #0000h, addr_1l Ofe0000h --> addr 

mov.b #00feh, addr_h 

mov.W #00ffh, r2 Read array command 

jsr Command_write command_write 

mov.w 0070h, r2 Read SRD command 

jsr Command_write command write 

mov.w alj],rl SRD read 

mov.W #00ffh, r2 Read array command 

jsr Command_write command_write 

mov.w 1,start_ent 

mov.w 3,send_cnt 

bset send_flg 

jmp Flash_func_end ; jump Flash_func_end 
, 
; 
z+ Clear SRD + 
, 
Clear_SRD: 

mov.w #0000h, addr_1 Ofe0000h --> addr 

mov.b #00feh, addr_h 

mov.W #00ffh, r2 Read array command 

jsr Command_write command write 

mov.W #0050h, r2 Clear SRD command 

jsr Command_write command write 

mov.W #00ffh, r2 Read array command 

jsr Command_write command write 

and.b #10011100b, SRD1 SRD1 clear 

mov.w #0, start_cnt 

mov.w #0, send_cnt 

belr send_flg 

jmp Flash_func_end ; jump Flash_func_end 
F 
; 
pt Read Lock Bit + 
; 
Read_LB 

mov.w #1,4r3 receive number (r3=1) 

mov.b #0feh, addr_1l addr_l = feh 
Read_LB_loop: 

mov.w r3,a0 r3 --> a0 

mov.b data[a0],r0l 

mov.b r01l,addr_1[a0] Store address 

add.w #1,4r3 r3 +1 increment 

cmp .w #3,4r3 r3=3 ? 

jltu Read_LB_loop jump Read_LB_loop at r3<3 

mov.W #0071h, r2 Read LB command 

jsr Command_write command write 

mov.w [al],rl read LB 

mov.W #00ffh, r2 Read array command 

jsr Command_write command write 
Read_LB_end 

mov.w #1,start_cnt 

mov.w #1,send_cnt 

bset send_flg 

jmp Flash_func_end ; jump Flash_func_end 
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a 


it Program Lock Bit 


v 
Program_LB: 

mov.w #1,xr3 

mov.b #0feh, addr_1l 
Program_LB_loop: 

mov.w r3,a0 

mov.b data[a0],r0l 
mov.b r01,addr_1 [a0] 

w 

w 


receive number (r3=1) 
addr_l = feh 


r3 --> a0 


Store address 
r3 +1 increment 


jump Program_LB_loop at r3<4 


Confirm command check 
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jump Program_LB_end at Confirm command error 


Program LB command 


Confirm command 


Read array command 


7 jump Flash_func_end 


; Lock disable bit = 0 


7 jump Flash_func_end 


; Lock disable bit = 0 
; Lock disable Bit 


ll 
bb 


7 jump Flash_func_end 


blank flag check 
jump ID_check_end at blank 
lower ID address check 


jump ID_error at ID address error 


higher ID address check 


jump ID_error at ID address error 


ID lower address --> rl 
check loop number (r3=1) 


add. 1;-x3 
cmp. 4,x3 r3=4 ? 
jltu Program_LB_loop 
cmp.b Od0h, data 
jne Program_LB_end 
mov.w 0077h, r2 
jsr Command_write command write 
mov.w 00d0h, r2 
mov.w r2, [al] command write 
mov.w OOffh, r2 
jsr Command_write command write 
Program_LB_end: 
mov.w 0, start_cent 
mov.w 0, send_cnt 
belr send_flg 
jmp Flash_func_end 
v 
, 
yt Lock Bit enable + 
, 
LB_enable: 
belr fmr02 
mov.w #0, Sstart_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp Flash_func_end 
v 
, 
yt Lock Bit disable + 
, 
LB_disable: 
belr fmr02 
bset fmr02 
mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp Flash_func_end 
v 
r 
yt ID check 
, 
ID_check: 
btst blank 
jc ID_check_end 
cmp.w Offdfh, addr_1l 
jne ID_error 
cmp .Ww 007ffh, addr_h 
jne ID_error 
ID_data_check: 
mov.w Offdfh,rl 
mov.w Lp tS 
ID_check_loop: 
mov.w r1l,a0 rl --> a0 
mov.w O00ffh,al 


ID higher address --> al 
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sha. 
add. 
mov. 
mov. 
cmp. 
jne 
add.w 
cmp .w 
jne 

mov.w 


Tf ORE 


add.w 
cmp .w 
jltu 
ID_OK: 
bset 
bset 
jmp 
ID_error: 
bset 
belr 


#16,al 
a0,al 
[al],r0l 
r3,a0 
r01l,data[a0] 
ID_error 
#4,r1 
#0ffe7h,r1 
?t+ 
#0ffebh,r1 


#1,4r3 
#8,4r3 
ID_check_loop 


sr10 
sril 
ID_check_end 


srl10 
sril 


ID_check_end: 
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ID data read from Flash memory 
r3 --> a0 

compare ID data 

jump ID_error at ID error 

rl +4 increment (next ID address) 
rl=O0ffefh ? 

jump ? at not equal 

rl=0ffeb at equal 


r3 +1 increment 
r3=8 ? 
jump ID_check_loop at r3<8 


ID check OK (srl11=1,sr10=1) 
jump ID_check_end 


ID error (sri11=0,sr10=1) 


mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp Flash_func_end ; jump Flash_func_end 
, 
r 
pt Boot output + 
r 
Boot_output: 
bclr fmr05 Boot ROM select 
mov.w #0,4r3 ; receive number (r3=1) 
mov.w #0,addr_1 ; addr_l = 0 
Boot_loop: 
add.w #1,xr3 ; v3 +1 increment 
mov.w r3,a0 2-3) ==> al 
mov.W data[a0],r0 
mov.b r01l,addr_1[a0] ; Store address 
cmp .w #2,%r3 7; r3 =3? 
jltu Boot_loop; jump Boot_output_loop at r3<3 
bset send_flg 
mov.w #3, start_cnt 
mov.w #258, send_cnt 
jmp Flash_func_end ; jump Flash_func_end 
, 
r 
Has Read check + 


’ 


Read_check: 


7 jump Flash_func_end 


; Boot ROM select 
7 jump Download_program 


mov.w #0, start_cnt 
mov.w #2, send_cnt 
bset send_flg 
jmp Flash_func_end 
, 
; 
t+ Download a 
; 
Download: 
belr fmr05 
jmp.a Download_program 
; 
; 
pt Version output + 
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Ver_output: 
mov.w #0, start_cnt 


mov.w #8, send_cnt 
bset send_flg 
jmp Flash_func_end 7 jump Flash_func_end 


, 
, 
Fae ie is Si i SS 
7+ Subroutine : a synchronized signal I/O receive data+ 
Fie ie is SL i i 
SIO_rcv_data: 


jsr set_TAO 
SIO_rcv_data_l1: 

btst ir_taOic ; time out error ? 

jne P+ 

jsr Time_over_flg 7 jump Time_over at time out 
2. 

btst ei ee 7 receive complete ? 

jne SIO_rcv_data_l 

mov.w ulrb, rcv_d ; veceive data read --> r0 

res 


, 


Fae eo is SL SS 
yt Subroutine : a synchronized signal I/O receive data+ 
File en is Sn 
SIO_rcv_data_rom: 


jsr set_TAO 
SIO_rcv_data_rom_1: 
btst ir_taOic ; time out error ? 
bmc fmr05 ; time out, User ROM select 
jne P+ 
jsr Time_over_flg 7 jump Time_over at time out 
See: 
btst fa VIEL 7 receive complete ? 
jnc SIO_rcv_data_rom_1 
mov.w ulrb, rcv_d ; veceive data read --> r0 
YES 


a 


ZEFLFFFTTLEFEFETTLFFEFETLEFFFET TELE TTTEFEFETEPEEEF EET P +++ 


7+ Subroutine : a synchronized signal I/O send + 
Fe is Ss SL LL 
SIO_send: 

jsr set_TAO 

jsr SIO_send_data 

jsr SIO_rcv_data 

rts 


, 


Foss is SS 
7+ Subroutine : a synchronized signal I/O send + 
Fe is Ss i 
SIO_send_rom: 


jsr set_TAO 

jsr SIO_send_data 

jsr SIO_rcv_data_rom 

rts 
v 
, 
7+ Transfer Program -—- UART mode + 
ea (1) Main flow + 
p+ (2) Flash control program + 
yt Read, Program, All_erase,Read_SRD,Clear_SRD + 
yt (3) Other program + 
p+ ID_check + 
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.org Trans_TOP2 
; 


FTEFFFT TT LFFFETTLEFEFET TE FFFFTTLLEFFFTE LEFT TTP EFFF EE ++ +44 


z+ Main flow - UART mode - + 
Fro iss Rs SL Oc oe 
U_Main: 

jmp U_SIO_init_first 


r 

U_Loop_main: 
mov.b SRD1,SRD1_bak 7 SRD1 back up 
mov.b SRD1,SRD1_bak+2 


jsr U_SIO_rcv 

mov.w rcev_d, r0 

mov.b r01,cmd_d 

mov.w #0,1r2 

mov.w r2,a0 

mov.b r01,data[a0] 

belr cmd_flg 
r 

jmp U_SIO_freq 
U_Flash_init: 

jsr U_time_init 

jmp U_SIO_rcv_first_data 
U_Flash_set: 

jmp U_Flash_func 
U_Flash_send: 

jmp U_SIO_send_data 
U_Flash_int: 

btst tint_flg 

jne U_Main_end 

jsr TInitialize_31 ; command error,UART mode Initialize 


; 
U_Main_end: 
jmp U_Loop_main 7 jump U_Loop_main 


pt initialize SIO + 


’ 


U_time_init: 


bset rcev_flg 
belr tint_flg 
rts 
7 
7 
r+ SI/O recieve data + 


U_SIO_rcv_first_data: 


btst rcev_flg 
jne U_SIO_rcv_end 
jc U_SIO_rcev_first_data_set 


U_SIO_rcev_first_data_loop: 


jsr U_SIO_rcv_only 

mov.w revid, r0 ; receive data --> r0 
U_SIO_rcev_first_data_set: 

mov.w r2,a0 


mov.b r01,data[a0] 
add.w #1,r2 


btst cmd_flg 
jc U_SIO_loop_chk 
bset cmd_flg 
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mov.b 


mov .w 
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r01l,cmd_d 


#20,a0 


U_SIO_rcv_command_chk: 


, 


, 


mov.b 
cmp.b 
jeq 
sbjnz.w 
jmp 


U_Index_tbl-Trans_TOP2+Ram_progTOP-1[a0],r0Oh 
rOh, r0l 

U_SIO_cmd_jmp_2 

#1,a0,U_SIO_rcev_command_chk 

U_STO_rcv_end 


| STO_cmd_jmp_2: 


shl.w 1,a0 
mov.W U_jmp_tb1_2-Trans_TOP2+Ram_progTOP-2[a0],r0 
STO_cmd_jmp_2_1: 
jmpi.w r0 
U_SIO_2: 
mov.w 2, loop_cnt 
jmp U_STIO_loop_chk 
U_SIO_259: 
mov.w 259, loop_cnt 
jmp U_STO_loop_chk 
U_SIO_4: 
mov.w 4,loop_cnt 
jmp U_SIO_loop_chk 
U_SIO_3: 
mov.w 3, loop_cnt 
jmp U_STIO_loop_chk 
;+ ID check SI/O + 


U_SIO_rcv_ID_check: 


mov.W 
mov.W 
mov.b 


#0,4r3 ; receive number (r3=0) 
#0ffh,al ; ID size (dummy data = ffh) 
#0,ta0ic 


U_SIO_ID_data_store: 


cmp .w 
jeq 
jsr 
mov. 
mov. 
mov. 
add. 
cmp. 
jne 
mov.b 
add.w 
jmp 


2 200 -e. = 


al,xr3 ; v3=al(ID size) 
U_SIO_ID_address_check; jump ID_address_check at r3=ID size 
U_SIO_rcv_only 

rcev_d,r0 


r3,a0 - pa =-3 2d 

r01,addr_1 [a0] ; Store address 

#1,4r3 ; v3 +1 increment 

#4,413 ; v3=4 ? 

U_SIO_ID_data_store ; jump ID_data_store at r3 not= 4 
data,al ; ID size --> al 

#4,al ; al=al+4 


U_SIO_ID_data_store ; jump ID_data_store 


U_SIO_ID_address_check: 


, 


jmp 


U_SIO_rcv_end 


U_SIO_rcv_end_1: 


bset 
jmp 


tint_flg 
U_SIO_rcv_end 


U_SIO_loop_chk: 


cmp.w 
jltu 


loop_cnt,r2 
U_SIO_rcev_first_data_loop 


U_SIO_rcv_end: 


belr 
belr 


jmp 


cmd_flg 
rev_flg 
U_Flash_set 
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z+ SIO_send data + 


’ 


U_SIO_send_data: 


btst send_flg 
jnc U_SIO_send_data_end 
mov.b cmd_d,rlh 
cmp.b #O0ffh,r1lh ; Read(ffh) 
jeq U_Read_data 
cmp.b #070h,rl1lh ; Read SRD (70h) 
jeq U_Read_SRD_data 
cmp.b #071h,r1h ; Read LB (71h) 
jeq U_Read_LB_data 
cmp.b #O0fbh,rlh ; Version_output (fbh) 
jeq U_Ver_output_data 
cmp.b #O0fdh,rlh ; Read_check (fdh) 
jeq U_Read_check_data 
cmp.b #0fch,rlh ; Boot_check (fch) 
jeq U_Boot_data 
cmp .b Ob0h, rlh ; BPS SET (bO0h) 
jeq U_BPS_BO_data 
cmp.b Oblh, rlh ; BPS SET (bl1h) 
jeq U_BPS_Bl_data 
cmp .b Ob2h, rlh ; BPS SET (b2h) 
jeq U_BPS_B2_data 
cmp .b Ob3h,rih ; BPS SET (b3h) 
jeq U_BPS_B3_data 
cmp.b 0b4h, rlh ; BPS SET (b4h) 
jeq U_BPS_B4_ data 
jmp U_STO_send_func 
U_Read_check_data: 
mov.w #0,4r3 
mov.w sum, r1 
U_Read_check_data_loop: 
mov.b rll,send_d 
jsr U_SIO_send 
mov.b rlh,ril 
add.w #1,4r3 
cmp .w #2,4r3 
jltu U_Read_check_data_loop 
U_Read_check_data_end: 
mov.w #0,sum j; reset 
jsr U_SIO_exit 
jmp U_SIO_send_data_end 
U_Read_data: 
mov.w Oyts 
U_Read_data_loop: 
mov.b al],ril ; Flash memory read 
mov.b rll1l,send_d 
jsr U_SIO_send 
add.w 1,xr3 
add.1 1,al 
cmp .w 256,23 fh r3S = 256 7 
jne U_Read_data_loop 
U_Read_data_end: 
jsr U_SIO_exit 
jmp U_SIO_send_data_end 
U_Ver_output_data: 
mov.w #0, a0 ; Version address offset (a0=0) 
U_Ver_output_data_loop: 
mov.b ver[a0],send_d ; send_data set 
jsr U_SIO_send 
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add.w #1,a0 

cmp .w #8, a0 ; 

jne U_Ver_output_data_loop 
U_Ver_output_data_end: 

jsr U_SIO_exit 

jmp U_SIO_send_data_end 
U_Read_SRD_data: 

mov.W #0,4r3 
U_Read_SRD_data_loop: 

mov.b rll1l,send_d ; 

jsr U_SIO_send 

mov.b SRD1,r11 ; 

add.w #1,xr3 

cmp .w #2,xr3 ; 

jltu U_Read_SRD_data_loop; 
U_Read_SRD_data_end: 

jsr U_SIO_exit 

jmp U_SIO_send_data_end 
U_Read_LB_data: 

mov.b rll,send_d ; 

jsr U_SIO_send 
U_Read_LB_data_end: 

jsr U_SIO_exit 

jmp U_SIO_send_data_end 


U_Boot_data 


belr fmr05 

mov.w addr_1,a0 

mov.b addr_h,al 

mov.Ww #0,4r3 

sha.l #16,al 

add.1 a0,al 
U_Boot_data_loop: 

mov.b {al],r1l ; 

mov.b rll1l,send_d 

jsr U_SIO_send 

add.w #1,xr3 

add.w #1,al 

cmp .w #256,4r3 is 

jne U_Boot_data_loop 
U_Boot_data_end: 

bset fmr05 

jsr U_SIO_exit 

jmp U_SIO_send_data_end 
U_BPS_BO_data: 

mov.b baud, data_BPS 

jmp U_BPS_SET_data 
U_BPS_B1l_data: 

mov.b baud+1,data_BPS 

jmp U_BPS_SET_data 
U_BPS_B2_data: 

mov.b baud+2,data_BPS 

jmp U_BPS_SET_data 
U_BPS_B3_data: 

mov.b baud+3, data_BPS 

jmp U_BPS_SET_data 
U_BPS_B4_ data: 

mov.b baud+4,data_BPS 
U_BPS_SET_data: 

mov.b r01,send_d 

jsr U_SIO_send 

jsr U_SIO_exit 
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a0 = 8 ? 


data transfer 


SRD1 data --> rll 


r3 2? 
jump Read_SRD_loop at r3<2 


data transfer 


Flash memory read 


; Baud 9600bps 


; Baud 19200bps 


; Baud rate 38400bps 


; Baud rate 57600bps 


; Baud ra 115200bps 
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jsr U_blank_end ; UART mode Initialize 
jmp U_SIO_send_data_end 


’ 


U_SIO_send_func: 


mov.W start_cnt,r3 
U_SIO_send_data_loop: 
mov.w r3,a0 


mov.b data[a0],r1l 
mov.b rll,send_d 


jsr U_SIO_send 
add.w #1,xr3 
cmp .w send_cnt,r3 ; v3 = send_cnt ? 
jne U_SIO_send_data_loop 
mov.w £3, 70 
U_SIO_send_data_end: 
belr send_flg 
jmp U_Flash_int 


’ 


FEET FHT LEFT FLEE FFFETLLEEFFTELLFFFFTELEFFFETEPEFEF EE + +444 


ek jump table for Flash_func + 
ZHEAFHEFEAFHEAAFEFEFEAAFEEEFEEEFEEEFEEEFEEEFEEEFEEFFEFEF EFF E AT 
U_jmp_tbl: 

.-word U_Read - U_cmd_jmp 

.word U_Program -— U_cmd_jmp 

.-word U_Erase -— U_cmd_jmp 

.-word U_All_erase - U_cmd_jmp 

.word U_Clear_SRD - U_cmd_jmp 

.word U_Read_LB - U_cmd_jmp 

.word U_Program_LB - U_cmd_jmp 

.word U_LB_ enable - U_cmd_jmp 

.-word U_LB_ disable - U_cmd_jmp 

.word U_Download - U_cmd_jmp 

.word U_Boot_output - U_cmd_jmp 

.word U_Read_check - U_cmd_jmp 


y 
FEHEEEEFAFEEFEFEEEEFEFEEFEFEFEFFEFEEEEFEFEEFEFEEEFFEFEE PE PT 
ed jump table for SIO_rcv_first_data + 
FFHEEEEFAFEEEEFEEEFFEFEEEEFEFEFFEFEEEEFEFEEFEFEEEF EEE EE EPH 
U_jmp_tb1l_2: 
.word U_STO_3 - U_SIO_cmd_jmp_2_1 ; Read 
.word U_SIO_259 - U_SIO_cmd_jmp_2_1 ; Program 
1 
1 


7 erase 
; All erase 


-word U_SIO_4 - U_SIO_cmd_jmp_2 
.word U_SIO_2 - U_SIO_cmd_jmp_2 
.word U_STO_rcv_end - U_SIO_cmd_jmp_2_1 7 Clear SRD 
-word U_SIO_3 - U_SIO_cmd_jmp_2_1 ; Read LB 
.word U_SIO_4 - U_SIO_cmd_jmp_2_1 

.word U_STO_rcv_end - U_SIO_cmd_j 
.word U_STO_rcv_end - U_SIO_cmd_j LB disable 
.-word U_STO_rcv_end - U_SIO_cmd_jmp_2_1 ; Download 
.word U_STIO_3 - U_SIO_cmd_jmp_2_1 7 Boot output 
.word U_STO_rcv_end - U_SIO_cmd_jmp_2_1 ; Read check 
.word U_SITO_rcv_end - U_SIO_cmd_jmp_2_1 ; Read SRD 
-word U_SITO_rcv_ID_check - U_SIO_cmd_jmp_2_1 ; ID check 


; LB Program 


jmp_2_1 ; LB enable 


8 
Ke) 

i) 

a 


.-word U_STO_rcv_end - U_SIO_cmd_jmp_2_1 ; Version out 
-word U_STO_rcv_end - U_SIO_cmd_jmp_2_1 ;  U_BPS_BO 
-word U_STO_rcv_end —- U_SIO_cmd_jmp_2_1 ;  U_BPS_B1 
.word U_STO_rcv_end - U_SIO_cmd_jmp_2_1 ;  U_BPS_B2 
.-word U_STO_rcv_end - U_SIO_cmd_jmp_2_1 ;  U_BPS_B3 
.word U_STO_rcv_end -— U_SIO_cmd_jmp_2_1 ;  U_BPS_B4 


, 
Fleiss pls piss ie i ois oi in a Sa a 
jt serch table for Flash_func, SIO_rcev_first_data + 
Foils Sis is ois isis i i oi 
U_Index_tbl: 

-byte Offh ; Read(ffh) 
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.byte 041h ; 
.byte 020h ; 
-byte Oa7h ; 
-byte 050h ‘ 
-byte O71h : 
-byte 077h : 
.byte O7ah 7 
-byte 075h ; 
-byte Ofah ; 
.byte Ofch ; 
-byte Ofdh ; 
-byte 070h ; 
-byte Of5h ; 
-byte Ofbh ; 
.byte Ob0h : 
.byte Oblh - 
.byte Ob2h ; 
-byte Ob3h - 
-byte Ob4h : 


, 


a 
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Program (41h) 

Erase (20h) 
All_erase (a7h) 
Clear SRD (50h) 

Read LBS (71h) 

LB program(77h) 

LB enable (7ah) 

LB disable (75h) 
Download (fah) 

Boot output (fch) 
Read check (fdh) 
Read SRD (70h) 

ID check (f£5h) 
Version output (fbh) 
BPS_SET 9600 (b0Oh) 
BPS_SET 19200 (blh) 
BPS_SET 38400 (b2h) 
BPS_SET 57600 (b3h) 
BPS_SET 115200 (b4h) 


pTHEFFFTTLEFEFTTTLFFFFE TELE FFE TELE FFFETTEFEFETEEEFEP EET ++ 4+ 


yt Subroutine 


Initialize_3 - UART mode 


+ 


ZEFEFFFTT LEFT TTLFFEFE TELE FFETEELEFFETTEFEFETETEFEF EET + +44 


Initialize_3: 


, 


yt Flash mode set + 
v 
, 
bset fmr05 ; User ROM select 
bcelr fmr01 ; Flash entry bit clear 
bset fmr01 ; Flash entry bit set (E/W mode) 
v 
r 
ae Blank check + 
r 
mov.w QfEfEFCh, ¢0 ; Reset vector read 
mov.w Offfffeh,rl ; Reset vector read 
and.w rly xrO ;, vO & rl 
cmp .w #O0ffffh, xr0 ; cO=ffffh ? 
jne U_blank_end 
bset srl10 ; check complete at r0=ffffh 
bset srll 
bset blank ; blank flag set 
U_blank_end: 
v 
r 
7+ UART1 + 
, 
pos UART init rate generator 1 
, 
mov.W data_BPS,ulbrg 
, 
Initialize_31: 
r 
belr pd6_2 , RxD input 
, 
aS Function select register AO 
r 
mov.b #10010000b, ps0 
, 
{SSS Function select register BO 
, 
mov.b #00000000b, psl10 
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(oa SSs UART1 transmit/receive mode register 


mov.b #0,ulcl ; transmit/receive disable 
mov.b #0,ulmr ; ulmr reset 
mov.b #00000101b, ulmr 
; I] ||| j++ SSS o> Ss > transfer data 8 bit long 
; || | | |}#------------ Internal clock 
; I] | |+ one stop bit 
; | |++ parity disabled 
; [+ sleep mode deselected 


mov.b # 


f1 select 


RTS select 

CRT/RTS enabled 
CMOS output (TxD) 
Must always be "0" 


’ UART transmit/receive control register 2 


mov.b #00000000b, ucon 


mov.b # 


rts 


Transmit buffer empty 
Invalid 

Must always be 
CTS/RTS shared 
fixed 


wow 


Transmission disabled 
Transmission enabled 
Reception disabled 
Reception enabled 
fixed 


FLASH function main 


’ 


U_Flash_func: 


mov.b cemd_d, r01 

mov.b #0ch, r0h 

and.b SRD1,r0h 

cmp.b #0ch,r0h 

jne U_Command_check_2 
mov.w #12,a0 


U_Command_check: 


; receive data --> rOl 


; #00001100b srl10,11 mask data 

; sr10,11 pick up 

; ID check OK? 

7 jump Command_check_2 at ID unchecked 


U_Index_tb1-Trans_TOP2+Ram_progTOP-1[a0],r0h 


mov.b 

cmp.b r0h, r01 

jeq U_cmd_jmp_1 

sbjnz.w  #1,a0,U_Command_check 
jmp U_Command_check_2 


U_cmd_jmp_1: 


shl.w #1,a0 

mov.w 
U_cmd_jmp: 

jmpi.w x0 


U_jmp_tb1-Trans_TOP2+Ram_progTOP-2[a0],r0 
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U_Command_check_2: 


?: cmp.b 070h, r0l 
jne P+ 
jmp U_Read_SRD 
?: cmp.b Of5h, r01 
jne P+ 
jmp U_ID_check 
?: cmp.b Ob0h, r0Ol 
jne P+ 
jmp U_BPS_BO 
?: cmp.b Ob1ih, r0Ol 
jne P+ 
jmp U_BPS_Bl 
?: cmp.b Ob2h, r0l 
jne P+ 
jmp U_BPS_B2 
?: cmp.b 0b3h, r0l 
jne P+ 
jmp U_BPS_B3 
?: cmp.b 0b4h, r0l 
jne P+ 
jmp U_BPS_B4 
?: cmp.b Ofbh, r0Ol 
jne U_Flash_func_end 
jmp U_Ver_output 
, 
U_Flash_func_end: 
jmp U_Flash_send 
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; Read SRD (70h) 

; ID check (£5h) 

; BPS_SET 9600 (b0h) 

7 BPS_SET 19200 (bth) 
; BPS_SET 38400 (b2h) 
7 BPS_SET 57600 (b3h) 
7 BPS_SET 115200 (b4h) 
; Version out (fbh) 


yt Read -— UART mode — + 
r 
U_Read: 
mov.w #0,xr3 ; receive number 
mov.b #0,addr_1 ; addr_l = 0 
U_Read_loop: 
add.w #1,xr3 ; v3 +1 increment 
mov.w r3,a0 PS aH AO 
mov.W data[a0],r0 
mov.b r01,addr_1 [a0] ; Store address 
cmp .w 2,X3 2 £3 = 2-2 
jltu U_Read_loop 7 jump Read_loop at r3<2 
mov.w OOffh, r2 ; Read array command 
jsr U_Command_write ; command_write 
bset send_flg 
mov.w 3, start_ent 
mov.w 258, send_cnt 
jmp U_Flash_func_end 7 jump Flash_func_end 
v 
, 
yt Program — UART mode - + 


; 
U_Program: 


mov.Ww #0,4r3 ‘ 
mov.b #0,addr_1 
mov.w sum, crcd : 
U_Program_loop_1: 

add.w #1,xr3 A 
mov.w r3,a0 ] 
mov.b data[a0],r0l 

mov.b r01,addr_1 [a0] : 
cmp .w #259,4r3 ‘ 
jltu U_Program_loop_1 


receive number 
addr_l = 0 
for Read check command 


r3 +1 increment 
r3 --> a0 


Store address 
r3 = 258 ? 
7 jump U_Program_loop at r3<258 
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mov.w #00ffh, r2 ; Read array command 
jsr U_Command_write ; command_write 
mov.w #0070h, r2 ; Read SRD command 
jsr U_Command_write ; command_write 
mov.w [al],rl ; SRD read 
mov.w #00ffh, r2 ; Read array command 
jsr U_Command_write ; command_write 
cmp.b #80h, r1l j error check 
jne U_Program_end 
r 
mov.w #0041h, r2 ; Page program command 
jsr U_Command_write ; command_write 
mov.w #0,4r3 ; writing number (r3=0) 
U_Program_loop_2: 
mov.b addr_h,al ; addr_h -—> al 
sha.l #16,al 
mov.w r3,a0 ers --> ad 
mov.w data[a0],r1l ; data eS IL 
mov.w addr_1,a0 ; addr_l,m --> a0 
add.1 a0,al 
mov.w r1, [al] ; data write 
r 
mov.b rll,crcin ; for Read check command 
mov.b fi eran 
r 
add.w #2,addr_1 ; address +2 increment 
add.w #2,%r3 ; writing number +2 increment 
cmp .w #255,4r3 7; v3 = 255 ? 
jltu U_Program_loop_2 ; jump U_Program_loop_2 at r3<255 


U_Program_end: 


mov.w crcd, sum ; for Read check command 

belr send_flg 

mov.w #0, send_cnt 

mov.w #0, start_cnt 

jmp U_Flash_func_end ; jump Flash_func_end 
r 
pt Block erase —- UART mode - + 
r 
U_Erase 

mov.w #1,xr3 ; receive number (r3=1) 

mov.b #0feh, addr_1l ; addr_l = feh 
U_Erase_loop: 

mov.w r3,a0 --¥3 =—> ad 

mov.b data[a0],r0l 

mov.b r01,addr_1[a0] ; Store address 

add.w #1,4r3 ; v3 +1 increment 

cmp .w #4,4r3 ; r3=4 ? 

jltu U_Erase_loop 7; jump at r3<4 

cmp .b #0d0h, data ; Confirm command check 

jne U_Erase_end 7 jump Erase_end at Confirm command error 

mov.w #0020h, r2 ; Erase command 

jsr U_Command_write ; command write 

mov.w #00d0h, r2 ; Confirm command 

mov.w r2, [al] ; command write 
U_Erase_end: 

mov.w #00ffh, r2 ; Read array command 

jsr U_Command_write ; U_command_write 

belr send_flg 

mov.w #0, send_cnt 

mov.w #0, start_cnt 

jmp U_Flash_func_end ; jump Flash_func_end 
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, 


yt All erase ( unlock block ) - UART mode - 


, 


U_All_erase: 


mov.w 1,a0 

mov.b data[a0],r0l 
cmp.b O0d0h, r0Ol : 
jne U_All_erase_end ; 


mov.w 0000h, addr_1 * 
mov.b O0O0feh, addr_h 


;receive data read --> r0 


Confirm command check 
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jump U_All_erase_end at Confirm command error 


Ofe0000h --> addr 


mov.w O0av7h, r2 ; All erase command 
jsr U_Command_write ; command write 
mov.w 00d0h, r2 ; Confirm command 
mov.w r2, [al] ; command write 
U_All_erase_end: 
mov.w OOffh, r2 ; Read array command 
jsr U_Command_write ; command_write 
belr send_flg 
mov.w 0, send_cnt 
mov.w 0, start_cent 
jmp U_Flash_func_end ; jump Flash_func_end 
v 
r 
yt Read SRD - UART mode 


, 


U_Read_SRD: 


mov.w Op FS ; veceive number (r3=0) 
mov.w 0000h, addr_1 ; Ofe0000h --> addr 
mov.b O0O0feh, addr_h 
mov.w OOffh, r2 ; Read array command 
jsr U_Command_write ; command_write 
mov.w 0070h, r2 ; Read SRD command 
jsr U_Command_write ; command write 
mov.w {al],rl ; SRD read 
mov.w OOffh, r2 ; Read array command 
jsr U_Command_write ; command_write 
mov.w 1,start_cent 
mov.w 3,send_cnt 
bset send_flg 
jmp U_Flash_func_end 7 jump Flash_func_end 
v 
, 
p+ Clear SRD —- UART mode 


U_Clear_SRD: 
mov.w 0000h, addr_1 , 
mov.b O0O0feh, addr_h 


Ofe0000h --> addr 


mov.w OOffh, r2 ; Read array command 
jsr U_Command_write ; command write 
mov.w 0050h, r2 ; Clear SRD command 
jsr U_Command_write ; command write 
mov.w OOffh, r2 ; Read array command 
jsr U_Command_write ; command write 
and.b 10011100b,SRD1 ; SRD1 clear 
mov.w 0, start_cent 
mov.w 0, send_cnt 
belr send_flg 
jmp U_Flash_func_end ; jump Flash_func_end 
v 
, 
yt Read Lock Bit - UART mode - 
, 
U_Read_LB: 
mov.w 17:63 ; receive number (r3=1) 
mov.b Ofeh, addr_1 ; addr_l = feh 
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U_Read_LB_loop: 


mov. 
mov. 
mov. 
add. 
cmp. 


mov. 
jsr 


r3,a0 
data[a0],r 
r0Ol,addr_l 
#1,2x3 
#3,4r3 
U_Read_LB__ 
re_ulcl 
#0071h, r2 


Ol 
[a0] ; 


loop ; 


U_Command_write 


fal],rl1 
#00ffh, xr2 


’ 


’ 


U_Command_write ; 
U_Read_LB_end: 


M16C/80 Group 
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r3 --> a0 


Store address 

r3 +1 increment 
r3=3 ? 

jump at r3<3 
Reception disabled 
Read LB command 

; command write 
read LB 

Read array command 
U_command write 


mov.w #1,start_cnt 

mov.w #1,send_cnt 

bset send_flg 

jmp U_Flash_func_end 7 jump Flash_func_end 
Fs 
r 
Hoa Program Lock Bit - UART mode - + 
r 
U_Program_LB: 

mov.w #1,4r3 ; receive number (r3=1) 

mov.b #0feh, addr_1 ; addr_l = feh 
U_Program_LB_loop: 

mov.w r3,a0 po ee =H al 

mov.b data[a0],r0l 

mov.b r01l,addr_1[a0] ; Store address 

add.w #1,4r3 ; v3 +1 increment 

cmp .w #4,4r3 ; v3=4 ? 

jltu U_Program_LB_ loop j; jump at r3<4 

cmp .b #0d0h, data ; Confirm command check 

jne U_Program_LB_end ; jump U_Program_LB_end at Confirm command error 

mov.w #0077h, r2 ; Program LB command 

jsr U_Command_write ; command write 

mov.w #00d0h, r2 ; Confirm command 

mov.w r2, [al] ; command write 

mov.w #00ffh, r2 ; Read array command 

jsr U_Command_write ; command write 


U_Program_LB_end: 


mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp U_Flash_func_end 7 jump Flash_func_end 
, 
r 
p+ Lock Bit enable - UART mode - + 
r 
U_LB_enable: 
belr fmr02 ; Lock disable bit = 0 
mov.w #0, start_cnt 
mov.w #0, send_cnt 
belr send_flg 
jmp U_Flash_func_end ; jump Flash_func_end 
, 
, 
r 
pt Lock Bit disable - UART mode - + 


’ 


U_LB_disable: 


belr 
bset 


mov .w 


mov .w 


fmr02 
fmr02 


#0, start_cnt 
#0, send_cnt 


a 


a 


Lock disable bit = 
Lock disable Bit 


ot 
ro 
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belr 
jmp 


send_flg 
U_Flash_func_end 
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7 jump Flash_func_end 


p+ ID check —- UART mode 


, 


U_ID_check: 


btst blank 

jc U_ID_check_end 

cmp .w Offdfh, addr_l 

jne U_ID_error 

cmp .w 007ffh, addr_h 

jne U_ID_error 
U_ID_data_check: 

mov.w Offdfh,rl 

mov.w teks 
U_ID_check_loop: 

mov.w OO0ffh,al 

sha.1l 16,al 

mov.w rl,a0 

add.1 a0,al 

mov.b al],r0l 

mov.w r3,a0 

cmp.b r01,data[a0] 

jne U_ID_error 

add.w 4,r1 

cmp.w Offe7h,rl 

jne P+ 

mov.w Offebh, rl 
28 

add.w 1, 43 

cmp .w 8, x3 

jltu U_ID_check_loop 
U_ID_OK: 

bset sxr10 

bset srll 

jmp U_ID_check_end 
U_ID_error: 

bset sr10 

bcelr srll 
U_ID_check_end: 

mov.w #0, start_cnt 

mov.w #0, send_cnt 

belr send_flg 

jmp U_Flash_func_end 


, 


, 


, 


, 


, 


blank flag check 

jump U_ID_check_end at blank 

lower U_ID address check 

jump U_ID_error at ID address error 
higher ID address check 

jump U_ID_error at ID address error 


ID lower address --> rl 
check loop number (r3=1) 


ID higher address --> al 
rl --> a0 
ID data read from Flash memory 


r3 --> a0 

compare ID data 

jump U_ID_error at ID error 

rl +4 increment (next ID address) 
rl=Offefh ? 

jump ? at not equal 

rl=0ffeb at equal 


r3 +1 increment 


r3=8 ? 
jump U_ID_check_loop at r3<8 


ID check OK (sr11=1,sr10=1) 
jump U_ID_check_end 


ID error (srl11=0,srl10=1) 


7 jump Flash_func_end 


rt 


Boot output - UART mode —- 


a 


U_Boot_output: 


belr fmr05 

mov.w #0,4r3 

mov.w #0,addr_1 
U_Boot_loop: 

add.w #1,xr3 

mov.w r3,a0 

mov.W data[a0],r0 

mov.b r01,addr_1 [a0] 

cmp .w #2,xr3 

jltu U_Boot_loop 

bset send_flg 

mov.w #3, start_cnt 

mov.w #258, send_cnt 

jmp U_Flash_func_end 


, 


; Boot ROM select 
receive number (r3=1) 
addr_1l 0 


r3 +1 increment 
r3 --> a0 


Store address 
r3 3.2 
jump at r3<3 


7 jump Flash_func_end 
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’ 


pt Read check + 


r 
U_Read_check: 
mov.w #0, start_cnt 


mov.w #2, send_cnt 
bset send_flg 
jmp U_Flash_func_end 7 jump Flash_func_end 
; 
; 
z+ Download — UART mode - + 


’ 


U_Download: 


belr fmr05 ; Boot ROM select 

jmp.a U_Download_program 7 Jump U_Download_program 
; 
i 
pt Version output - UART mode - + 


; 
U_Ver_output: 
mov.w #0, start_cnt 


mov.w #8, send_cnt 
bset send_flg 
jmp U_Flash_func_end 7 jump Flash_func_end 


, 

Fils ris isis isis i i 
jt Subroutine : Command write - UART mode + 
Fils ris is ois isis i i i i i 
U_Command_write: 


btst fmr00 ; RY/BY status check 
jz U_Command_write 

mov.w addr_1,a0 ; addr_l,m --> a0 
mov.b addr_h,al ; addr_h -—> al 
sha.1 #16,al 

add.1 a0,al 

mov.w r2, [al] ; command write 

Les 


, 
PELEEEEFAFEEEEEEEFEEEEEEEEEEEEEEEEEEEEEEEEEEE LEAF EEE E EPH TE 
pk Main init first — UART mode - + 
PELEEFEFEEEEEEFEEFEEEEEEEEEEEEEEEEEEEEEEEEEEE LEE FEE HEPA TE 
U_SIO_init_first: 
beclr freq_setl ; freq set flag clear 
belr freq_set2 
mov.b #01111111b,data_BPS ; Initialize Baud rate 
; mov.b #129,data_BPS ; Initialize Baud rate 9600bps for 20MHz 
jsr Initialize_3 ; UART mode Initialize 
mov.b #01000000b,r11 ; counbterl,2 reset 
mov.b #10000000b,r1h 


jsr U_SIO_rcev 
; 
mov.w rcv_d, r0 ; receive data --> r0 
btst freq_set2 
jz U_Freq_check 
jmp U_Loop_main 


’ 


FEEFFFTTLEFFFET TE FFEFETELEFFFETLLEFFFTELEFFFETEPEFFE EE ++ +44 


it SIO init - UART mode - + 
FAEFEEEAEEFEE EEE FEEEEEE EEE EEFEFEEEFEFEE EEE EEEAEE EEE EEF EP EH4 
U_SIO_freq: 

btst freq_set2 

jz U_Freq_check 

jmp U_Flash_init 
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ZTFLFFFTTLLFEFETTLFFEFETTLFFFFTTEEFEFETTEFEFETEPEEEP EE H+ +44 


7+ Freq check 


— UART mode - + 


ZFFLFFFTHTTEFEFETTLFFEFETELFFFETTEEFFFTTTEFEFETEPEFEP ETP + 44+ 


U_Freq_check: 


bcelr re_ulcl 

btst 0,rlh 

jc U_Freq_check_4 
, 

btst freq_setl 

jc U_Freq_check_1 

btst 5,r0h 

jz U_Freq_check_3 

jmp U_Freq_check_2 
U_Freq_check_1: 

cmp.b #00h, rOl 

jeq U_Freq_check_3 
U_Freq_check_2: 

or.b rlh,ril 
U_Freq_check_3: 

xor.b data_BPS,ril 

mov.b rll1,data_BPS 

mov.b rlh,ril 

rot.b #-1,r11 

rot.b #-1,r1h 

rot.b #-1,r11 

jmp U_Freq_check_6 


, 


U_Freq_check_4: 


btst freq_setl 

jc U_Freq_set_1 ;, Yes , 

bset freq_setl 

btst 5p eo 

jz U_Freq_check_5 

xor.b data_BPS,rih 

mov.b rilh,data_BPS 
U_Freq_check_5: 

mov.b data_BPS, data_BPS+1 ; 

mov.b #01000000b, r11 

mov.b #10000000b,r1h 

mov.b #10000000b,data_BPS ; 
U_Freq_check_6: 

jsr U_blank_end 
2s 

btst p6_6 

jz 2 

jmp U_Loop_main 


, 


U_Freq_set_1: 


cmp.b #00h, rOl 

jeq U_Freq_set_2 

xor.b data_BPS,rih 

mov.b rilh,data_BPS 
U_Freq_set_2: 

bset freq_set2 

mov.b data_BPS,ril 

sub.b data_BPS+1,r11 

shl.b #-1,r11 

add.b data_BPS+1,r11 
, 

mov.b rll,baud 

shl.b #-1,r11 

mov.b rll1,baud+1 

shl.b #-1,r11 

mov.b r11,baud+2 

mov.b baud, r0l 


; Reception disabled 
; counter = 8 times 


; fer_ulrb 


7 NOOnN? 


; rll = counterl or counter2 


; Baud = Baud xor rll 


; data set 


, counter sift 


; Baud get ? 
finished 


; fer_ulrb 


Min Baud --> datatl 
7 counter reset 


Reset 


; UART mode Initialize 


"00h"? 


; Max Baud --> data 


7 9600bps 
; 19200bps 


; 38400bps 


7 57600bps 
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mov.b 0,xr0Oh 
divu.b 6 
mov.b r01,baud+3 
mov.b baud+3,r01 ; 115200bps 
shl.b -1,r01 
mov.b r01,baud+4 
mov.b baud, data_BPS 
mov.b Ob0h, r01l ; “"BOh" set 
jsr U_blank_end ; UART mode Initialize 
jmp U_BPS_SET_data 
, 
r 
p+ Baud rate change - UART mode + 
r 
U_BPS_BO: 
U_BPS_B1: 
U_BPS_B2: 
U_BPS_B3: 
U_BPS_B4: 
mov.w #0, start_cnt 
mov.w #1,send_cnt 
bset send_flg 
jmp U_Flash_func_end ; jump Flash_func_end 


’ 


FTEFFFTT FLEET TLLEFEFETTLEFFFETTEFFFFTELEFFFETTPEFEP EE ++ 444+ 


pt Subroutine : serial I/O send - UART mode + 
Fs is i 
U_SIO_send: 

bcelr re_ulcl 

bset te_ulcl 

mov.b send_d,ultb ; transmit buffer register 
2. 

btst ti_ulcl ; transmit buffer empty? 

jne ?- 

res 


, 

Fils ris Sis Sis isis i i LL i 
jt Subroutine : serial I/O send — UART mode + 
Foils ris ois ois isis i oi i i SS 
U_SIO_send_only: 


mov.b send_d,ultb ; transmit buffer register 
2s 

btst ti_ulcl ; transmit buffer empty? 

jne 2s 

rts 
PEFEEEEAEEEEEEEEEFEEEEEEEEEFEEEEEEEEEEEEEEEEELEF EEE TT 
at Subroutine : serial I/O receive - UART mode + 
PEELE EFAEEEEEEEEFFEEEEEEEEEEEEEEEEEEEEEEEEEEL EEE E EEE EPH TT 
U_SIO_rcv: 

bcelr te_ulcl 

bset re_ulcl 
os 

btst ri_ulcl ; receive complete? 

jne 2 

mov.w ulrb, rcv_d 

rEs 


, 

Fs is Ss 
pt Subroutine : serial I/O receive - UART mode + 
PEFEEEEAAEEEEEEEEFEEEEEEEEEEEEEEEEEEEEEEEEEEE LEAF EEE EPH AE 
U_SIO_rcev_only: 


btst ri_ulcl ; receive complete? 
jnc 2 
mov.w ulrb, rcv_d 
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rts 
, 


ZFTLAFFTTTEFEFETTLFFEFETELFEFETTEFEFFEETEFEFETEPEFEF EET + +++ 


7+ Subroutine : serial I/O receive - UART mode + 
Fo sa a i 
U_SIO_exit: 

btst txept_ulc0d 

jne U_SIO_exit 

rts 
v 
, 
p+ Vector Table + 
, 

.section inter, romdata 

-Org Vector 
r, 

.lword Reset 7; UNO 

.lword Reset ; INTO 

.lword Reset ; BRK 

.lword Reset ; address matchnig 

.lword Reset ; 

.lword Reset ; WDT 

.lword Reset 7 

.lword Reset ; NMI 

.lword Reset ; Reset 
, 

.end 
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Header 


PRR RRR KK RRR KR KR KKK KKK KE KK KKK KEK KKK KK KKK ERK KEK KEK KKK KEK ER 


’ 


’ 


1 


’ 


’ 


* 
* 
* 
1 
* 
* 
* 


’ 


1 
’ 


v 


file name 


definition of M16C/80 Flash 


0.04 ( 1999- 4-28 
for Boot Ver.1.00 


KKK KKK KKK KKK KKK KKK KK KKK KKK KK KKK KKK KK KKK KKK KKK KKK KKK KKK 


BUSY output 


busy 
busy_d 


’ 


’ 
’ 


’ 


-btequ 
-btequ 


4,03C0h 7; po_4 
4,03C2h 7 pd6_4 


Serial I/O select bit 


s_mode 
s_mode_d 


’ 


’ 
’ 


’ 


-btequ 
-btequ 


5,03C0h 7 po 


5 


5,03C2h 7; pdo_5 


define of symbols 


Ram_TOP 


Ram_ 


Istack 


r 
Version 
Boot_TOP 


END 


[Trans_TOP1 


rans_| 
[Trans_TOP2 


END1 


Vector 


7 
Download_program 
U_Download_program 


i 

SB_base 
Ram_progTOP 
Ram_progEND 


’ 


-section 


rans_1 


END2 


Org 


equ 
.equ 
equ 


equ 
equ 
equ 
equ 
equ 
equ 
equ 


equ 
equ 
equ 


me 
Ra 


-blkb 
-blkb 
-blkb 
-blkb 
-blkb 
-blkb 
-blkb 
-blkb 
-blkb 
-blkb 
-blkb 
-blkb 
-blkb 


-btequ 
-btequ 


000400h 
O00bffh 
000c00h 


Offe000h 
Offe020h 
Offe200h 
Offe700h 
Offe800h 
Offeds80h 
Offffdch 


-equ OffeOfOh 
-equ Offel70h 


000400h 
000600h 
000B80h 


mory,data 
m_TOP 


BrPrRPRP PRP 


NON WRReP 
SS 
oO 


On FR 


0, SRD 
1,SRD 
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sr2 -btequ 2,SRD 
sr3 -btequ 3,SRD 
sr4 -btequ 4,SRD 
sr5 -btequ 5,SRD 
sr6 -btequ 6,SRD 
sr7 -btequ 7,SRD 
sr8 -btequ 0,SRD1 
sx9 -btequ 1,SRD1 
sxr10 -btequ 2,SRD1 
srll -btequ 3,SRD1 
sxr12 -btequ 4,SRD1 
srl13 -btequ 5,SRD1 
srl1l4 -btequ 6,SRD1 
sxr15 -btequ 7,SRD1 
r 

ram_check -btequ 0,SF 
blank -btequ 1,SF 
old_mode -btequ 2,SF 
freq_setl -btequ 3,SF 


freq_set2 -btequ 4,SF 
, 


, 
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4.4 Precautions 


This section describes precautions to be observed when controlling the M16C/80's internal flash memory. 


When Powering On/Off 


When powering on/off, pay attention to the following: 

(1) Be careful that noise will not get into the control pins (WE, CE, OE). If a noise pulse is applied to the 
control pins when turning the power on or off, a program/erase error will occur, which in the worst case 
may destroy the memory data. 

(2) A finite wait time is required before you can start read or program/erase operation after power-on. 
Specifically, a wait time of 2 us is required before read or program/erase operation can be started after 
Vcc reached Vccmin (3.0 V). 
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5.2 ROM Code Protect Function 


5 Internal Flash Memory Rewrite Inhibit Function 
5.1 ID Code 


5.1 ID Code 


To prevent illegal leakage of a program, the M16C flash memory allows ID data to be set (called the "ID 
code"). This section describes how to inhibit the internal flash memory against rewriting by using ID data. 


What Is The ID Code? 


The ID code is the ID data that is written into the internal flash memory beforehand in order to inhibit the 
flash memory against rewriting. 

When exercising control, enter the ID from the programmer newly again and only when it matches the ID 
data stored in the flash memory, you can control program or read operation. 

The ID code for the M16C/20 and 62's flash memory is fixed to 7 bytes in length. The areas in which to 
store the ID code are address FFFDF 16, address FFFE316, address FFFEB16, address FFFEF16, address 
FFFF316, address FFFF716, and address FFFFB16. 

The ID code for the M16C/80's flash memory is fixed to 7 bytes in length. The areas in which to store the 
ID code are address FFFFDF16, address FFFFE316, address FFFFEB16, address FFFFEF 16, address 
FFFFF316, address FFFFF716, and address FFFFFB16. 


FFFDF 16 ID1 


FFFE316 ID2 


FFFEBI« 


FFFEF16 ID4 | | Fixed to 7 bytes in length 


FFFF316 ID5 


FFFFBI« 


Figure 5.1.1 ID Codes of The M16C/20 and 62 
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Processing Flow 


Figure 5.1.2 shows a flow of the main program using ID code. 


Determined by flag, etc. 
No 
ID checked? 


Command 


=] 


Yes 


ID check 


Error handling 


Figure 5.1.2 Flow of The Main Program Using ID Code 


How to Set ID Code 


5:1 


ID Code 


The addresses at which ID code is set overlaps the fixed vector area. Therefore, set the logical sum of 
each interrupt's jump address and the ID code as fixed vector. A description example is shown in Figure 


5.1.3. 


org OFFFDCH 


UDI: 


OVER_FLOW: 
BRKI: 


ADDRESS MATCH: 


SIN 


WDT: 
DBC: 
NMI: 


RESET: 


.lword dummy_int | 01000000H 
.lword dummy_int | 23000000H 
lword dummy_int 
.lword dummy_int | 45000000H 
GLE_STEP: 

.lword dummy_int | 67000000H 

.lword dummy_int | 89000000H 


.lword dummy_int | OABOOO000H 


word dummy_int | 0CD000000H 


.lword 


ID code 
Interrupt jump address 


Figure 5.1.3 Description Example for ID Code Setting (M16C/20, 62) 
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Setting ID Code by Imc30, Imc308 


The load module converters (Imc30, Imc308) included with the assemblers for Mitsubishi M16C (AS30, 
AS308) allow any ID code to be set in a load module when generating the load module. 

The following shows an example of command settings necessary to set ID code when generating load 
modules. For details about the load module converters (Imc30, Imc308), refer to the AS30 User's Manual 
or AS308 User's Manual. 


Example 1: Imc30 -ID Code No1 sample ("CodeNo1" specified using ASCII code) 
ID code : 436F64654E6F31 


Table 5.1.1 ID Code Setting Example 


ID1 ID2 ID3 ID4 ID5 | ID6 | ID7 
Address | FFFDFie | FFFE3ie | FFFEBis | FFFEFie | FFFF316 | FFFF7ie | FFFFBi6 


Example 2: Imc30 -ID Code sample ("Code" specified using ASCII code) 
ID code : 436F6465000000 


Example 3: Imc30 -ID1234567 sample ("1234567" specified using ASCII code) 
ID code : 31323334353637 


Example 4: Imc30 -ID#49562137856132 sample ("49562137856132" specified using HEX code) 
ID code : 49562137856132 


Example 5: Imc30 -ID1234567 sample ("1234567" specified using HEX code) 
ID code : 12345670000000 


Example 6: Imc30 -ID sample 
ID code : FFFFFFFFFFFFFF 
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5.2 ROM Code Protect Function 


To prevent illegal leakage of a program, the M16C flash memory allows you to limit rewriting of ROM code 
(called the "ROM code protect"). This section describes how to limit rewriting of the internal flash memory by 
using the ROM code protect function. 


What is The ROM Code Protect Function? 


The ROM code protect function reading out or modifying the contents of the flash memory version by using 
the ROM code protect control address (OFFFFF16) during parallel I/O mode. Figure 5.2.1 shows the ROM 
code protect control address (OFFFFF 16). (This address exists in the user ROM area.) 

If one of the pair of ROM code protect bits is set to 0, ROM code protect is turned on, so that the contents 
of the flash memory version are protected against readout and modification. ROM code protect is 
implemented in two levels. If level 2 is selected, the flash memory is protected even against readout by a 
shipment inspection LSI tester, etc. When an attempt is made to select both level 1 and level 2, level 2 is 
selected by default. 

If both of the two ROM code protect reset bits are set to “00,” ROM code protect is turned off, so that the 
contents of the flash memory version can be read out or modified. Once ROM code protect is turned on, 
the contents of the ROM code protect reset bits cannot be modified in parallel I/O mode. Use the serial I/O 
or some other mode to rewrite the contents of the ROM code protect reset bits. 


ROM code protect control address 


b7 b6 b5 b4 b3 b2 bi b0 Symbol Address When reset 
ROMCP OFFFFF16 (M16C/20, 60) FFi6 
FFFFFF16 (M16C/80) 


: [_Bit symbol 


.| Reserved bit Always set this bit to 1. 


ROM code protect level bebe 
ROMCP2 |o5 cot bit (Note 1, 2) 00: Protect enabled 


01: Protect enabled 
10: Protect enabled 
11: Protect disabled 


b5 b4 

00: Protect removed 

01: Protect set bit effective 
10: Protect set bit effective 
11: Protect set bit effective 


ROM code protect reset 
bit (Note 3) 


ROM code protect level O7.86 
RM 1 set bit (Note 1) 00: Protect enabled 


01: Protect enabled 
10: Protect enabled 
11: Protect disabled 


Note 1: When ROM code protect is turned on, the on-chip flash memory is protected against 
readout or modification in parallel input/output mode. 

Note 2: When ROM code protect level 2 is turned on, ROM code readout by a shipment 
inspection LSI tester, etc. also is inhibited. 

Note 3: The ROM code protect reset bits can be used to turn off ROM code protect level 1 and 
ROM code protect level 2. However, since these bits cannot be changed in parallel input/ 
output mode, they need to be rewritten in serial input/output or some other mode. 

Note 4: This bit is defined as the reserved bit in M16C/20 group. Must set "1" to it. 


Figure 5.2.1 ROM Code Protect Control Address 
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How to Set ROM Code Protect Control Addresses 


The addresses at which ROM code protect is set overlaps the fixed vector area. Therefore, set the logical 
sum of the reset jump address and the set value of ROM code protect bit as fixed vector. A description 


example is shown in Figure 5.2.2. 


.org 
UDI: 

.lword 
OVER_FLOW: 

.lword 
BRKI: 

.lword 
ADDRESS_ MATCH: 

.lword 
SINGLE_STEP: 

.lword 
WDT: 

.lword 
DBC: 

.lword 
NMI: 

.lword 
RESET: 

.lword 


OFFFDCH 

dummy_int | 01000000H 
dummy_int | 23000000H 
dummy_int 

dummy_int | 45000000H 
dummy_int | 67000000H 
dummy_int | 89000000H 
dummy_int | OABOO0000H 
dummy_int | OCDO00000H 


Reset jump address ROM code protect control 
address 


Figure 5.2.2 Description Example for ROM Code Protect Control Address (M16C/20,62) 
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Internal Flash Memory Rewrite Inhibit Function 
ss) 5.2 ROM Code Protect Function 


Setting ROM Code Protect by Imc30, Imc308 


The load module converters (Imc30, Imc308) included with the assemblers for Mitsubishi M16C (AS30, 
AS308) allow any ROM code protect function to be set in a load module when generating the load module. 
The following shows an example of command settings necessary to set ROM code protect function when 
generating load modules. For details about the load module converters (Imc30, Imc308), refer to the AS30 
User's Manual or AS308 User's Manual. 


Example 1: Imc30 -protect 1 sample (Set ROM code protect function level 1) 
Protect code : 3F16 


Example 2: Imc30 -protect 2 sample (Set ROM code protect function level 2) 
Protect code : F316 


Example 3: Imc30 sample (Without ROM code protect function setting) 
Protect code : Data described in source program 
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